Linux Kernel 6.12.104

The 113 most recent commits in this release — the full changelog is longer:

• Linux 6.12.104
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• ima: Instantiate file_truncate and path_truncate hooks
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• mm/huge_memory: fix huge_zero_pfn race
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: qcom-geni: fix TX DMA buffer flush
• nvmem: layouts: Add fixed-layout driver
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• kunit/fortify: Add back "volatile" for sizeof() constants
• kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
• futex: Prevent robust futex exit race some more
• crypto: ccp - Abort doing SEV INIT if SNP INIT fails
• crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
• KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
• crypto: ccp - Add new SEV/SNP platform shutdown API
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• blk-mq: reinsert cached request to the list
• blk-mq: pop cached request if it is usable
• block: Reorder the request allocation code in blk_mq_submit_bio()
• KVM: s390: pci: Fix aisb calculation
• KVM: s390: pci: Fix resource leak on IRQ registration failure
• KVM: s390: pci: Fix missing error codes and memory unaccounting
• KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• mac802154: fix netdev use-after-free in beacon worker
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• net: fix skb length accounting after generic XDP frag adjustment
• packet: synchronize pressure clearing with ring reconfiguration
• net/packet: reset the MAC header on the packet-socket transmit path
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ipvs: stop estimator after disabled calc phase
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ipheth: fix carrier_work UAF on disconnect
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• swapfile: call cond_resched() before locking si->lock
• mtd: spinand: repeat reading in regular mode if continuous reading fails
• mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails
• mtd: spinand: fix direct mapping creation sizes
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• net: fec: do not release NULL pages when RX buffer allocation fails