Linux Kernel 6.6.152

The 114 most recent commits in this release — the full changelog is longer:

• Linux 6.6.152
• regulator: devres: fix devm_regulator_get_enable_read_voltage() return
• net/tcp_sigpool: Use kref_get_unless_zero()
• net/tcp_sigpool: Fix some off by one bugs
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• Revert "drm/amdgpu: fix aperture mapping leak"
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• fscrypt: Replace mk_users keyring with simple list
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• fortify: Disable -Wstringop-overread in tests
• fortify: refactor test_fortify Makefile to fix some build problems
• futex: Prevent robust futex exit race some more
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• KVM: s390: pci: Fix aisb calculation
• KVM: s390: pci: Fix resource leak on IRQ registration failure
• KVM: s390: pci: Fix missing error codes and memory unaccounting
• KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• mac802154: fix netdev use-after-free in beacon worker
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• packet: synchronize pressure clearing with ring reconfiguration
• net/packet: reset the MAC header on the packet-socket transmit path
• packet: use consistent hard_header_len in TX_RING send path
• packet: use consistent hard_header_len in non-ring send paths
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ipvs: stop estimator after disabled calc phase
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• net: fec: do not release NULL pages when RX buffer allocation fails
• hwmon: (ads7828) Fix external VREF regulator handling
• regulator: devres: add API for reference voltage supplies
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
• net/tcp: Add TCP-AO config and structures
• net/tcp: Prepare tcp_md5sig_pool for TCP-AO
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks