Linux Kernel 7.1.5

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.5
• Revert "gpib: cb7210: Fix region leak when request_irq fails"
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race
• posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
• drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
• iomap: consolidate bio submission
• exfat: fix implicit declaration of brelse()
• exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
• exfat: add balloc parameter to exfat_map_cluster() for iomap support
• exfat: replace unsafe macros with static inline functions
• crypto: xilinx-trng - Remove crypto_rng interface
• liveupdate: validate session type before performing operation
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: atm: ueagle-atm: remove function entry/exit debug messages
• usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
• xfs: add newly added RTGs to the free pool in growfs
• xfs: factor out a xfs_zone_mark_free helper
• ksmbd: use opener credentials for FSCTL mutations
• smb: move compression definitions into common/fscc.h
• ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• binder: cache secctx size before release zeroes it
• binder: Use LIST_HEAD() to initialize on stack list head
• ALSA: hda/tas2781: Cancel async firmware request at unbind
• firmware_loader: Add cancel helper for async requests
• ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
• ALSA: scarlett2: Allow selecting config_set by firmware version
• iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
• f2fs: fix listxattr handling of corrupted xattr entries
• f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
• f2fs: fix potential deadlock in f2fs_balance_fs()
• device property: initialize the remaining fields of fwnode_handle in fwnode_init()
• samples/damon/mtier: fail early if address range parameters are invalid
• mm/damon/core: trace esz at first setup
• bpf: Reject negative const offsets for buffer pointers
• mmc: sdhci-esdhc-imx: fix resume error handling
• mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
• mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
• mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
• mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
• mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
• mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
• mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
• mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
• mmc: block: fix RPMB device unregister ordering
• mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
• mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
• mtd: rawnand: fsl_ifc: return errors for failed page reads
• mmc: vub300: defer reset until cmd_mutex is unlocked
• mtd: mchp23k256: use SPI match data for chip caps
• mtd: onenand: samsung: report DMA completion timeouts
• mtd: virt-concat: free duplicate generated name
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations
• wifi: mac80211: validate extension-frame layout before RX
• wifi: mac80211: free ack status frame on TX header build failure
• wifi: ieee80211: validate MLE common info length
• wifi: cfg80211: validate EHT MLE before MLD ID read
• powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
• powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
• reset: sunxi: fix memory region leak on ioremap failure
• reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
• ipvs: reload ip header after head reallocation
• ipvs: fix more places with wrong ipv6 transport offsets
• memstick: ms_block: reject a card that reports too many blocks
• macsec: fix promiscuity refcount leak in macsec_dev_open()
• llc: fix SAP refcount leak when creating incoming sockets
• crypto: aes - Fix conditions for selecting MAC dependencies
• Bluetooth: btrtl: validate firmware patch bounds
• net: openvswitch: reject oversized nested action attrs
• regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
• arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
• riscv: vdso: Do not use LTO for the vDSO
• wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
• wifi: mac80211: fix memory leak in ieee80211_register_hw()
• wifi: mwifiex: fix roaming to different channel in host_mlme mode
• wifi: rt2x00: avoid full teardown before work setup in probe
• net/mlx5: free mlx5_st_idx_data on final dealloc
• powerpc/pseries: fix memory leak on krealloc failure in papr_init
• mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
• selftests/landlock: Fix screwed up pointers in the scoped_signal_test
• selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
• pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
• pmdomain: imx: Fix i.MX8MP power notifier
• pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
• pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
• cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
• selftests/rseq: Fix a building error for riscv arch
• s390/mm: Fix type mismatch in get_align_mask().
• s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
• tracing/osnoise: Call synchronize_rcu() when unregistering
• riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
• drbd: reject data replies with an out-of-range payload size
• ata: libata-core: Allow capacity transition to zero for locked drives
• ata: libata-core: Skip HPA resize for locked drives
• fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
• fs/resctrl: Free mon_data structures on rdt_get_tree() failure
• cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
• arm64: smp: Fix hot-unplug tearing by forcing unregistration
• amdkfd: properly free secondary context id
• net: macb: drop in-flight Tx SKBs on close
• dibs: loopback: validate offset and size in move_data()
• macsec: don't read an unset MAC header in macsec_encrypt()
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
• ipvs: use parsed transport offset in SCTP state lookup
• llc: fix SAP refcount leak in llc_ui_autobind()
• selftests: net: make busywait timeout clock portable
• octeontx2-pf: fix SQB pointer leak on init failure
• mac802154: remove interfaces with RCU list deletion
• s390/monwriter: Reject buffer reuse with different data length
• irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
• mm/compaction: handle free_pages_prepare() properly in compaction_free()
• riscv: probes: save original sp in rethook trampoline
• hwmon: (asus_atk0110) Check package count before accessing element
• net: ipa: fix SMEM state handle leaks in SMP2P init
• net: wwan: iosm: bound device offsets in the MUX downlink decoder
• ata: libata-core: Reject an invalid concurrent positioning ranges count
• ata: pata_pxa: Fix DMA channel leak on probe error
• ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
• net/mlx5: HWS, fix matcher leak on resize target setup failure