Linux Kernel 6.1.184

The 107 most recent commits in this release — the full changelog is longer:

• Linux 6.1.184
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
• Bluetooth: mgmt: fix pending command UAF in EIR updates
• Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
• Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
• udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
• Bluetooth: hci_sync: Fix not using correct handle
• binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
• mm/huge_memory: fix huge_zero_pfn race
• net/x25: fix use-after-free of the socket by its timers
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• af_packet: Don't send zero-byte data in tpacket_snd().
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: conntrack: sctp: use nf log infrastructure for invalid packets
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• openvswitch: move key and ovs_cb update out of handle_fragments
• net: sched: use skb_ip_totlen and iph_totlen
• openvswitch: use skb_ip_totlen in conntrack
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• veth: fix skb length accounting after XDP frag adjustment
• veth: Introduce veth_xdp_buff wrapper for xdp_buff
• mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
• can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
• can: rcar_canfd: Invert reset assert order
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: bcm-iproc: remove printout on handled timeouts
• binfmt_misc: restore write access when removing an entry
• fs: don't block write during exec on pre-content watched files
• fsnotify: opt-in for permission events at file open time
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• veth: convert frag_list skbs before running XDP
• net: pktgen: fix proc entry use-after-free
• net: pktgen: fix code style (WARNING: Block comments)
• igc: remove napi_synchronize() in igc_down()
• ksmbd: reject repeated SMB2 NEGOTIATE requests
• ksmbd: conn lock to serialize smb2 negotiate
• Bluetooth: hci_sync: Fix advertising data UAFs
• Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1
• Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings
• overflow: Change DEFINE_FLEX to take __counted_by member
• mm/vmstat: fold stranded per-cpu node stats when a node comes online
• Bluetooth: mgmt: fix UAF in pair command cancellation
• Bluetooth: MGMT: Protect mgmt_pending list with its own lock
• Bluetooth: MGMT: Remove unused mgmt_pending_find_data
• Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
• Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
• erofs: cap LZMA stream pool size
• erofs: maintain cookies of share domain in self-contained list
• erofs: tidy up internal.h
• mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
• mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte()
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• smb/server: rename include guard in smb_common.h
• super: fix emergency thaw deadlock on frozen block devices
• ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
• ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
• ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• net: gro: fix double aggregation of flush-marked skbs
• net: move skb_gro_receive_list from udp to core
• libceph: fix two unsafe bare decodes in decode_lockers()
• ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: rename _to_client() to _to_fs_client()
• ceph: pass the mdsc to several helpers
• libceph: add doutc and *_client debug macros support
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: avoid fs reclaim while using current->journal_info
• sctp: avoid auth_enable sysctl UAF during netns teardown
• mptcp: pm: userspace: fix use-after-free in get_local_id
• mptcp: pm: use addr entry for get_local_id
• mptcp: add mptcp_userspace_pm_lookup_addr helper
• mptcp: pm: avoid code duplication to lookup endp
• mei: bus: access mei_device under device_lock on cleanup
• ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
• wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
• wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
• wifi: brcmfmac: drain bus_reset work on device removal