Linux Kernel 6.6.151

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.6.151
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
• ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
• drm/i915/hdcp: check streams[] bounds before overflow
• drm/i915/hdcp: require monotonically increasing seq_num_v
• drm/i915/hdcp: Move to using intel_display in intel_hdcp
• drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind
• drm/i915/fbc: Extract intel_fbc_has_fences()
• sctp: close UDP tunnel sockets during netns teardown
• mptcp: pm: userspace: fix use-after-free in get_local_id
• mptcp: pm: use addr entry for get_local_id
• mptcp: add mptcp_userspace_pm_lookup_addr helper
• mptcp: pm: avoid code duplication to lookup endp
• ceph: fix refcount leak in ceph_readdir()
• ceph: print cluster fsid and client global_id in all debug logs
• libceph: add doutc and *_client debug macros support
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• sctp: avoid auth_enable sysctl UAF during netns teardown
• sysctl: treewide: constify ctl_table_header::ctl_table_arg
• wifi: brcmfmac: drain bus_reset work on device removal
• wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
• wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
• wifi: ath6kl: fix use-after-free in aggr_reset_state()
• media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
• media: v4l: async: Set owner for async sub-devices
• netfilter: nf_tables: clone set on flush only
• rxrpc: Fix irq-disabled in local_bh_enable()
• media: imx219: Fix maximum frame length in lines
• media: i2c: imx219: Rename VTS to FRM_LENGTH
• media: i2c: imx219: Calculate crop rectangle dynamically
• media: i2c: imx219: Group functions by purpose
• media: i2c: imx219: Drop IMX219_VTS_* macros
• media: i2c: imx219: Don't store the current mode in the imx219 structure
• media: i2c: imx219: Access height from active format in imx219_set_ctrl
• drm/i915/vrr: require valid min/max vfreq for VRR
• drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
• drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
• drm/tegra: fbdev: Remove offset into framebuffer memory
• drm/fb-helper: Allocate and release fb_info in single place
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• usb: typec: ucsi: Only enable supported notifications
• usb: gadget: f_tcm: synchronize delayed set_alt with teardown
• drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
• drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du
• usb: musb: omap2430: Do not put borrowed of_node in probe
• usb: musb: omap2430: clean up probe error handling
• Revert "ia64: Make acpi_cpufreq_cpu_exit return void"
• gpio: pch: use raw_spinlock_t for the register lock
• firmware: stratix10-svc: fix memory leaks and list corruption bugs
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
• iommu/sva: move x86 disable check before allocation
• ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
• ata: libahci_platform: Do not set mask_port_map when not needed
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
• s390/dasd: Fix undersized format-check buffer
• s390/dasd: Fix potential NULL pointer dereference
• s390/qeth: Check CAP_NET_ADMIN for private ioctls
• power: supply: bq25890: fix the -10 C NTC lookup entry
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
• i2c: amd-mp2: Unregister callback on adapter add failure
• hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
• hwmon: (npcm750-pwm-fan): stop fan timer on device detach
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
• selftests/clone3: fix wild pointer access of getline due to missing init