Linux Kernel 7.1.8

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.8
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• drm/amd/display: Exit idle optimizations before programming
• drm/amd/display: check GRPH_FLIP status before sending event
• media: chips-media: wave5: Support CBP profile
• drm/xe: Wait on external BO kernel fences in exec IOCTL
• drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
• drm/xe: Set TTM device beneficial_order to 9 (2M)
• drm/xe: Separate early xe_device initialization
• drm/xe: Move xe->info.devid|revid initialization
• drm/xe: Move xe->info.force_execlist initialization
• drm/xe: Drop unused param from xe_device_create()
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• drm/xe/rtp: Ensure locking/ref counting for OA whitelists
• drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
• drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
• drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
• drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
• drm/xe/rtp: Generalize whitelist_apply_to_hwe
• drm/xe/rtp: Keep track of non-OA nonpriv slots
• drm/xe/rtp: Maintain OA whitelists separately
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: enforce cursor size limits for MOB cursors
• drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
• drm/vmwgfx: clamp dirty-page range with min, not max
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amd/display: use proper context for logging
• drm/amd/display: Silence link_dpms I2C retimer failures
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
• drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
• drm/amd/display: check if dml21_add_phantom_plane() is successful
• drm/amd/pm: use milliwatts for GPU power sensors
• drm/amd/pm: hide pp_table sysfs on APUs
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
• drm/panthor: validate firmware interface structure sizes
• drm/panthor: reject firmware sections with oversized data
• drm/bridge: display-connector: Fix I2C adapter resource leak
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: imx: mark I2C adapter when hardware is powered down
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
• i2c: spacemit: request IRQ after controller initialization
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
• s390/zcrypt: Close speculative mem read possibility
• s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
• s390/dasd: Fix undersized format-check buffer
• s390/dasd: Fix potential NULL pointer dereference
• s390/qeth: Check CAP_NET_ADMIN for private ioctls
• s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
• power: supply: max17040: handle missing status supplier
• power: supply: macsmc: Support macOS 27 SMC firmware
• power: supply: bq25890: fix the -10 C NTC lookup entry
• cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• cpufreq: cppc: Sanitize lockless policy limit snapshots
• cifs: add fscache_resize_cookie() to cifs_setsize()
• gpio: pch: use raw_spinlock_t for the register lock
• gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
• gpiolib: tolerate gpio-hogs lacking a hogging state
• i2c: amd-mp2: Unregister callback on adapter add failure
• hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
• hwmon: (npcm750-pwm-fan): stop fan timer on device detach
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write