XanMod Kernel 7.1.6-xanmod1

7.1.6-xanmod1
Changed 1
  • net: mana: Optimize irq affinity for low vcpu configs
Fixed 16
  • cifs: fix time_last_write stamp placement in setattr/truncate paths
  • KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
  • bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
  • mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
  • xfs: don't replace the wrong part of the cow fork
  • fuse-uring: fix race between registration and connection abortion
Security 3
  • ksmbd: validate ACE size against SID sub-authorities
  • ksmbd: bound DACL dedup walk to copied ACEs
  • ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  • 6db734bb161f Linux 7.1.6-xanmod1
  • ba65783d88c0 Merge tag 'v7.1.6' into 7.1
  • 2609d60e2f6d Linux 7.1.6
  • 96f1a2309bd4 cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
  • edfc6bf57524 cifs: fix time_last_write stamp placement in setattr/truncate paths
  • 6b542d116ace KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
  • a86ceb3291ec selftests: drv-net: so_txtime: relax variance bounds
  • ea2e0c28609a selftests: drv-net: cope with slow env in so_txtime.py test
  • 97c09c9f5739 sched_ext: Preserve rq tracking across local DSQ dispatch
  • 046899bcfc2d sched_ext: Move shared helpers from ext.c into internal.h and cid.h
  • 1e37f12b040e bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
  • 18c946a3b7b0 bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
  • 63ba393d279c net: mana: Optimize irq affinity for low vcpu configs
  • 760c47bce6f5 mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
  • 9ea8940dec3d mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
  • 390187672abf SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
  • ee055a047290 SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
  • 8fe8da8edc45 xfs: don't replace the wrong part of the cow fork
  • 2cd945492bc5 fuse-uring: fix race between registration and connection abortion
  • 3b601938314c audit: fix recursive locking deadlock in audit_dupe_exe()
  • ea5ded52bd08 audit: use 'unsigned int' instead of 'unsigned'
  • e528ff627fde drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
  • 61fd3559199f ksmbd: validate ACE size against SID sub-authorities
  • a0ebdaa79e10 ksmbd: bound DACL dedup walk to copied ACEs
  • bc90144ce8bb ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
  • 5acbd3012fd4 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  • a75b4f3fe9cd selftests: drv-net: add missing kconfig for psp.py
  • be354ea7261c drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
  • caf4f872eec3 drm/amd/pm: fix smu13 power limit range calculation
  • f5988b5c300a drm/amdgpu: fix aperture mapping leak
  • 1050d258c7c5 drm/amdgpu: reject mapping a reserved doorbell to a new queue
  • 930a5dc3df4a drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
  • 92789e28b08f drm/amdgpu: fix resource leak on ACP reset timeout
  • 5bc93f907bad drm/amdgpu: Fix kernel panic during driver load failure
  • be725ab23aa4 drm/amdgpu: fix division by zero with invalid uvd dimensions
  • afdff9103818 drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
  • c309626bf91f drm/amdgpu/vcn4: avoid rereading IB param length
  • 00c311a13d22 drm/amdgpu/vce: fix integer overflow in image size
  • 253b1401862b drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
  • cbe3b293d0ee drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
  • 6423b44b2e0b drm/amdgpu/mes11: set doorbell offset for suspending userq
  • 301f39acf779 drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
  • 6b4e19378d94 drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
  • 43768ad42b8f drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
  • ac89ea915e8b drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
  • db85aa861b82 drm/amdgpu/gfx8: drop unecessary BUG_ON()
  • 81597685c0d7 drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
  • 4fbcd92047ff drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
  • 51f67bd8a71a drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
  • 1c27e889fa16 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
  • 2929a932b0d7 drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
  • 69a2c5be437b drm/amd/pm: make pp_features read-only when scpm is enabled
  • 1c2a60c187ec drm/amd/pm: fix amdgpu_pm_info power display units
  • 9423c88cde9a watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
  • 54a3c27b357d vxlan: mdb: Fix source list corruption on a failed replace
  • 23b44803112a vsock/virtio: collapse receive queue under memory pressure
  • f9596b156661 tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
  • 22cec809b048 tcp: challenge ACK for non-exact RST in SYN-RECEIVED
  • a859b280441f tcp: initialize standalone TCP-AO response padding
  • 0f54f5048615 rtase: Workaround for TX hang caused by hardware packet parsing
  • bed4caecd723 pppoe: reload header pointer after dev_hard_header()
  • ee6c5b5194f1 ovpn: hold peer before scheduling keepalive work
  • f08f39c1f43f ovpn: fix peer refcount leak in TCP error paths
  • ea85dbcbe8d4 openvswitch: fix GSO userspace truncation underflow
  • 06a6b606129c mctp: serial: handle zero-length frames to prevent rx buffer overflow
  • e09e0301d616 mac802154: llsec: reject frames shorter than the authentication tag
  • 5f303f622f6b mac802154: hold an interface reference across the scan worker
  • c6a13ae00dab ila: reload IPv6 header after pskb_may_pull in checksum adjust
  • 33dc0dfb480e ice: use READ_ONCE() to access cached PHC time
  • 33cc15aaf249 ice: reject out-of-range ptype in ice_parser_profile_init
  • 689b9f588d2d gve: fix Rx queue stall on alloc failure
  • b62c510f5980 ksmbd: validate minimum PDU size for transform requests
  • 0ff12308c8a6 ksmbd: defer destroy_previous_session() until after NTLM authentication
  • 6e4d2eeccfb9 smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
  • b1a613669332 rbd: Reset positive result codes to zero in object map update path
  • 4c483644d1a7 super: fix emergency thaw deadlock on frozen block devices
  • 14fceda28069 ice: fix PTP Call Trace during PTP release
  • 545a7fdbc110 ptp: ptp_s390: Add missing facility check
  • 6d828e3a353c s390/ptff: Export ptff_function_mask[]
  • 21231d8c6ca4 proc: Fix broken error paths for namespace links
  • 7479c6e8235c net: qrtr: ns: Raise node count limit to 512
  • 6bbdf8744de3 net: pcs: xpcs: fix SGMII state reading
  • a0f247d63489 net: hip04: fix RX buffer leak on build_skb failure
  • fc0c0f7a207f net: gro: fix double aggregation of flush-marked skbs
  • 9aabda553184 net/x25: fix use-after-free in x25_kill_by_neigh()
  • fb29e1b41052 net/sched: serialize qdisc_rtab_list against concurrent get/put
  • a60c81f168c9 net/mlx5e: Use sender devcom for MPV master-up
  • f579582c03ed net/iucv: fix use-after-free of a severed iucv_path
  • 0e857185591f net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
  • 95f45e20f1b2 geneve: require CAP_NET_ADMIN in the device netns for changelink
  • 0e37bbd6d617 net: slip: serialize receive against buffer reallocation
  • e8ad0d311e22 vxlan: require CAP_NET_ADMIN in the device netns for changelink
  • 25e3641beb51 phonet: pep: fix use-after-free in pep_get_sb()
  • d0bba984703d net: stmmac: intel: skip SerDes reconfig when rate is unchanged
  • 9b243e2f1756 mm/slab: fix a memory leak due to bootstrapping sheaves twice
  • 0b7f04a0abb4 mm/slub: fix lost local objects when bulk remote free batch fills
  • db57cc63a6e5 iommu/vt-d: Disallow SVA if page walk is not coherent
  • c5b6a48a8a71 iomap: fix out-of-bounds bitmap_set() with zero-length range
  • 579b0f5c528c io_uring/rw: fix missing ERESTARTSYS conversion in read paths
  • e807c9193d94 ftrace: Add global mutex to serialize trace_parser access
  • bc2d630296e0 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  • 466f187b501a fscrypt: Add missing superblock check in find_or_insert_direct_key()
  • ca03a7984a34 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
  • 64017df6e61a fs/super: fix emergency thaw double-unlock of s_umount
  • 69ecc199880b binfmt_elf_fdpic: only honour the first PT_INTERP
  • d2cba2e7a513 ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
  • e01f47367a63 ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
  • 006340cf0688 amt: fix use-after-free in AMT delayed works
  • b9fedda2f628 libceph: remove debugfs files before client teardown
  • 70998f91030e libceph: reject zero bucket types in crush_decode
  • 3b249546f59c libceph: Reject monmaps advertising zero monitors
  • 5ecfcd5c0586 libceph: refresh auth->authorizer_buf{,_len} after authorizer update
  • db9cc9fd9660 libceph: guard missing CRUSH type name lookup
  • a54be593d0b7 libceph: fix two unsafe bare decodes in decode_lockers()
  • bee4b5b53e7b libceph: Fix multiplication overflow in decode_new_up_state_weight()
  • e36663145abd libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
  • 0d934c934ec7 libceph: bound get_version reply decode to front len
  • 0ce001e7fdf7 ceph: fix writeback_count leak in write_folio_nounlock()
  • f3247851d63e ceph: fix refcount leak in ceph_readdir()
  • 71893c342a26 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
  • 37ff9794be48 sctp: close UDP tunnel sockets during netns teardown
  • a50e73488e0b sctp: avoid auth_enable sysctl UAF during netns teardown
  • d136b29bf91d sctp: don't free the ASCONF's own transport in DEL-IP processing
  • 7375e2699582 mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  • ab6209f4b48a mm/page_vma_mapped: fix device-private PMD handling
  • a4b3a8dcc3d0 mm/memory-failure: trace: change memory_failure_event to ras subsystem
  • 02542f35129d mm/kmemleak: fix checksum computation for per-cpu objects
  • e33adf96afb5 mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  • f4145cec7005 m68k: avoid -Wunused-but-set-parameter in clear_user_page()
  • 43aaddd0fa92 mm/damon/core: validate ranges in damon_set_regions()
  • 0c26202b157f userfaultfd: prevent registration of special VMAs
  • 31a62e4ad663 btrfs: do not try compression for data reloc inodes
  • bfdfc7782ada afs: Fix afs_edit_dir_remove() to get, not find, block 0
  • c019163e9382 selftests: mptcp: userspace_pm: fix undefined variable port
  • 40dde4b5d982 mptcp: pm: userspace: fix use-after-free in get_local_id
  • fb3f056a9416 mptcp: only set DATA_FIN when a mapping is present
  • 625fc6060864 mptcp: fix stale skb->sk reference on subflow close
  • cb9d3163ef38 mptcp: fix BUILD_BUG_ON on legacy ARM config
  • d6d2261e3475 mptcp: decrement subflows counter on failed passive join
  • 4cf89c430acc Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
  • e59c2476ef75 arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
  • f3530aec2656 arm64: make huge_ptep_get handled unaligned addresses
  • 5b50f9fd58be tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()
  • b174d40adda6 tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
  • 02d6f022c7ff tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
  • 1ddf73ad334f tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
  • 1e8d254cb586 tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
  • 8f188dd11a1c ublk: wait on ublk_dev_ready() instead of ub->completion
  • 9899a6af1c5e tracing: Propagate errors from remote event bulk updates
  • be94a3a77e7e tracing: perf: Fix stale head for perf syscall tracing
  • 43a23dfe0024 tracing: Fix union collision of module and refcnt for dynamic events
  • cb459fec4f7b tracing: Fix resource leak on mmiotrace trace_pipe close
  • 724cd84b0546 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  • 57027f360231 tracing: Fix context switch counter truncation
  • 159fdc3e01dc tracing: Delay module ref count for "enable_event" trigger
  • 9e9a82d00c3d misc: nsm: pin the module while the device is open
  • f318f5a872cb misc: nsm: only unlock nsm_dev on post-lock error paths
  • c3a28f9cb824 intel_th: fix MSC output device reference leak
  • 7cf79e8d682f mei: bus: access mei_device under device_lock on cleanup
  • e089aa3f09ce selftests: ntsync: correct CONFIG_NTSYNC name
  • 8cbad52ccfa6 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
  • 863230250dd5 serial: sc16is7xx: implement gpio get_direction() callback
  • f5f663469ad2 uio_hv_generic: Bind to FCopy device by default
  • 5d059ce0e6a2 comedi: comedi_parport: deal with premature interrupt
  • 6ed367bbbf4d x86/boot/compressed: Disable jump tables
  • b5ed54a37ad5 firmware: stratix10-svc: handle NO_RESPONSE in async poll
  • 7b14f42c7460 firmware: stratix10-svc: fix teardown order in remove to prevent race
  • 8e93a083456d firmware: stratix10-svc: fix memory leaks and list corruption bugs
  • 4169d9fb92f3 rhashtable: clear stale iter->p on table restart
  • f3e2715a1500 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
  • 496bc868d906 LoongArch: Retrieve CPU package ID from PPTT when available
  • 881e9f3c4e11 LoongArch: Move jump_label_init() before parse_early_param()
  • a30a69678fca LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
  • eca63bd15580 LoongArch: Fix oops during single-step debugging
  • 3cfc4bd63574 LoongArch: Fix build errors due to wrong instructions for 32BIT
  • 7a54e0cbaad4 LoongArch: Fix address space mismatch in kexec command line lookup
  • 2d342c8b79c1 objtool/rust: add one more noreturn Rust function for Rust 1.99.0
  • fd661e6c1f64 rust: allow clippy::unwrap_or_default globally
  • a73bcfeacd67 rust: allow suspicious_runtime_symbol_definitions lint for Rust >= 1.98
  • d7c36d58f16d rust: device: avoid trailing ; in printing macros
  • 132fc107b973 rust: time: fix as_micros_ceil() to round correctly for negative Delta
  • 9be9bb59f485 rust_binder: only print failure if error has source
  • 95e27b4ba4e5 platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
  • 5ccc99d58f94 binfmt_misc: set have_execfd only once the interpreter is opened
  • 55fa2c7f2b15 exec: fix unsigned loop counter wrap in transfer_args_to_stack()
  • 98bc68194e37 Bluetooth: RFCOMM: Fix session UAF in set_termios
  • fe13adc258df Bluetooth: hci_sync: Protect UUID list traversal
  • 5968fd6c3f68 staging: rtl8723bs: fix inverted HT40 secondary channel offset
  • 23c31f107b4f staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
  • 17a4298f7794 wifi: ath12k: fix NULL pointer dereference in rhash table destroy
  • 65ee82c5ee84 wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
  • a1734263befc wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
  • 0ca80328df23 wifi: brcmfmac: make release_scratchbuffers idempotent
  • 177a25be1195 wifi: brcmfmac: drain bus_reset work on device removal
  • 03d3291c4b37 wifi: mt76: restrict NPU/PPE active checks to MMIO devices
  • 9677e86a5f7d wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
  • 24475d2ddc8d wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
  • b2ab73b8123c wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
  • 8ccdf8c8de87 wifi: wilc1000: validate assoc response length before subtracting header
  • cca4398aa305 wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
  • a3313111b5d9 wifi: ath6kl: fix use-after-free in aggr_reset_state()
  • cec0a487cf38 wifi: ath6kl: fix OOB access from firmware ADDBA window size
  • c1078130a4cd ALSA: timer: don't re-enter an instance callback that is still running
  • 2b2989977868 ALSA: timer: drain a slave's callback before its master detaches it
  • 089b8985a299 ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
  • 31a6163e301d ALSA: seq: close a re-opened queue timer in the destructor
  • f7ba6fa309d4 ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
  • 1a0e99470a0b media: vpif_capture: fix OF node reference imbalance
  • 6d51ad8f1c50 media: vivid: fix cleanup bugs in vivid_init()
  • daf2d92669b4 media: vivid: check for vb2_is_busy() when toggling caps
  • 90204e98c016 media: vivid: add vivid_update_reduced_fps()
  • dd29c4abad00 media: vimc: fix reference leak on failed device registration
  • 260346526b8e media: vidtv: fix reference leak on failed device registration
  • b9b02035b129 media: verisilicon: Export only needed pixels formats
  • 941bf408c5e5 media: vb2: use ssize_t for vb2_read/vb2_write
  • f7b3a27e35a3 media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
  • 067887ff93fd media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
  • b01df98a6669 media: v4l2-ctrls: validate HEVC active reference counts
  • ccf9c59704f8 media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
  • cd2bcc565619 media: uapi: rkisp: Correct name version enum
  • fcbbaf9cb972 media: ti: vpe: unwind v4l2 device registration on probe error
  • abfaa1b2670c media: ti: vpe: Fix the error code of devm_request_irq()
  • 956879b173c2 media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()
  • 6171b55640da media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()
  • b83120604a39 media: tegra-video: vi: fix invalid u32 return value in format lookup
  • 7dd27810eea0 media: synopsys: hdmirx: Fix HPD lane hold time
  • 668face37fdb media: sun4i-csi: Return queued buffers on start_streaming() failure
  • 4b7ee504969e media: stm32: dcmi: unregister notifier on probe failure
  • 624af2d4b5e9 media: stm32-dcmipp: Return queued buffers on start_streaming() failure
  • 1731dd61b6c0 media: saa7134: Fix a possible memory leak in saa7134_video_init1
  • 18aa963948b7 media: rzv2h-ivc: Wait for frame end in stop_streaming
  • a6709ee3c922 media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
  • fc0b18782aab media: rtl2832_sdr: Return queued buffers on start_streaming() failure
  • 90d781711418 media: rtl2832: fix use-after-free in rtl2832_remove()
  • 730c235d7d2c media: radio-si476x: Unregister v4l2_device on probe failure
  • 9ce597c8bdb4 media: qcom: camss: Fix RDI streaming for CSID 340
  • 0495a46a30af media: qcom: camss: Fix RDI streaming for CSID GEN3
  • e0d11cb8b54c media: qcom: camss: Fix RDI streaming for CSID GEN2
  • ea87d4242723 media: qcom: camss: Fix RDI streaming for CSID 680
  • a4f8f629983f media: pwc: Return queued buffers on start_streaming() failure
  • 5d4812668b03 media: pwc: Drain fill_buf on start_streaming() failure
  • 0c2b4c45fce0 media: pci: dm1105: Free allocated workqueue
  • 26edee412cbe media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
  • 75cdfaa7c908 media: nxp: imx8-isi: Fix potential out-of-bounds issues
  • fe127ea278b9 media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
  • 9ac81a2bbf70 media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
  • 9c5ddbabc31f media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
  • 65ddc021d39d media: nuvoton: npcm-video: fix memory leaks in probe and remove
  • 410398f06c28 media: nuvoton: npcm-video: fix error handling in npcm_video_init()
  • 3673cb0a5711 media: msi2500: Return queued buffers on start_streaming() failure
  • 99f3527bd1a2 media: meson: vdec: Fix memory leak in error path of vdec_open
  • cbe66053094f media: marvell-cam: fix missing pci_disable_device() on remove
  • 3adde045236a media: mali-c55: Power-off the peripheral in remove()
  • 65d442427584 media: mali-c55: Fix possible ERR_PTR in enable_streams
  • f83262ac4437 media: mali-c55: Disable pm_runtime on probe error
  • f9879931b492 media: mali-c55: Add missing of_reserved_mem_device_release()
  • 49cdf03d95e7 media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
  • 54b70e8e682f media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges
  • 739e289bfb6d media: imx219: Fix maximum frame length in lines
  • eb2f934646ae media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
  • e1a6465500b0 media: dw9719: Add back the I²C device id table
  • ff3c670a1de3 media: cx23885: add ioremap return check and cleanup
  • e797e252bfb3 media: cx231xx: fix devres lifetime
  • d681227ce43b media: chips-media: wave5: Move src_buf Removal to finish_encode
  • e53112c2de88 media: cedrus: skip invalid H.264 reference list entries
  • 4c2237c1f8c8 media: cedrus: Fix missing cleanup in error path
  • 578cb3701dd3 media: cedrus: clean up media device on probe failure
  • e94851429828 media: cec: seco: unregister adapter on IR probe failure
  • 578cff91d0b5 media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
  • 32cbe5474e74 media: amlogic-c3: Add validations for ae and awb config
  • 170fcc945bc0 media: airspy: Return queued buffers on start_streaming() failure
  • eeaa0c5feb91 drm/v3d: Reach the GMP through the hub registers on V3D 7.x
  • adf0542659c7 drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
  • b7fd42da6cb3 drm/gpusvm: Zero HMM PFNs before scanning ranges
  • 921d6acd5761 drm/ttm/pool: back up at native page order
  • 296f4c78f8da drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION
  • fe168ef1d232 drm/vc4: Prevent shader BO mappings from becoming writable
  • 6910ccaf4167 drm/vmwgfx: Validate vmw_surface_metadata::array_size
  • 095f1a2502eb drm/pagemap: Clear driver-provided PFNs from migration PFN array
  • c58088a8e744 drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
  • bac4c1a9af69 drm/vc4: Shut down BO cache timer before teardown
  • 57c85f13a3df drm/amd/display: Fix flip-done timeouts on mode1 reset
  • 55440dd29e74 drm/amdgpu: always emit the job vm fence
  • 7d088935c72c drm/amdgpu: Print vmid, pasid and more task info in devcoredump
  • 9743f6001327 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
  • 50d8e10bf867 drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
  • 1191285ecb42 drm/amd/display: Fix backlight max_brightness to match exported range
  • 3665fc7f93f1 drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
  • ed2d86aef9fa drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  • 9a5a582ad96a drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
  • 0676fecbb524 drm/amd/display: set new_stream to NULL after release
  • b2c51a7e5786 drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
  • 42e80ecdb188 drm/amd: Create a device link between APU display and XHCI devices
  • 3085ae8695e0 drm/amdgpu/userq: fix indefinite fence wait during GPU reset
  • 23131f1f930d drm/amdgpu: Fix VFCT bus number matching with soft filter
  • 9b7de3ee5d2c drm/amdgpu: Release VFCT ACPI table reference
  • f59825d834c0 drm/panthor: return error on truncated firmware
  • 9ddaabf38f7a drm/ttm: Account for NULL and handle pages in ttm_pool_backup
  • 72e4fca5529e drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
  • 7475273d88d8 drm/virtio: Don't detach GEM from a non-created context
  • b5a62e022f42 drm/gfx10: Program DB_RING_CONTROL
  • 5ee1c5784157 drm/amd/pm: fix smu14 power limit range calculation
  • 9061fbf2230b drm/i915/mst: limit DP MST ESI service loop
  • edd4804f07b8 drm/i915/gt: Fix NULL deref on sched_engine alloc failure
  • 97f236379f06 drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
  • 6cdbef8f60f3 drm/i915/gem: Do not leak siblings[] on proto context error
  • 28ebf07444b0 drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue
  • 5d5fb9124a2b drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
  • 29b4939bd44c drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
  • 625f301e01bf drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
  • 15fd21a9bba2 drm/amdgpu/soc24: reset dGPU if suspend got aborted
  • 8887b94d2fc9 drm/i915/bios: range check LFP Data Block panel_type2
  • 58b7e63ca0cd drm/i915: Return NULL on error in active_instance
  • 0027cb19b044 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
  • 2051bbbfbd44 drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
  • 9df8a7f09e30 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
  • bcbd53d25da8 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
  • 1a07ac63ae5b drm/amdgpu: add the doorbell index input for suspending userq
  • 984085c5b535 drm/i915/hdcp: check streams[] bounds before overflow
  • 41747d37cf56 drm/i915/hdcp: require monotonically increasing seq_num_v
  • c726c8bbee51 drm/i915/vrr: require valid min/max vfreq for VRR
  • 375c1934ef01 drm/virtio: bound EDID block reads to the response buffer
  • fba211b078d6 Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
  • 58ea24dd9684 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
  • dbad70d40cad drm/amd/display: use kvzalloc to allocate struct dc
  • b1bd5c2b24f5 drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
  • ee4efff4b65c drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x
  • 000c405fa153 drm/amdkfd: free MQD managers on DQM init failures
  • 865532d54eb5 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
  • cc10a5839756 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
  • abeeb1947d81 drm/amdkfd: Check bounds in allocate_event_notification_slot
  • 72c7d449778d drm/amdkfd: Use kvcalloc to allocate arrays
  • 1874a9414cbc drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size
  • a0d87beb2660 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
  • 15f58d44c244 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
  • 401fbe3b6bbb drm/imagination: fix error checking of pvr_vm_context_lookup()
  • 09beaf4aec05 drm/imagination: Fix user array stride in pvr_set_uobj_array()
  • c1136d907fd0 drm/imagination: Fix double call to drm_sched_entity_fini()
  • a6bdbff8f6f5 drm/xe/madvise: Skip invalidation for purgeable state updates
  • 50b6a61d8834 drm/xe/nvm: fix writable override for CRI
  • 90e4fd331b98 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
  • c4affa4e8bc8 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
  • ba8c4cbb31c6 drm/xe: Hold a dma-buf reference for imported BOs
  • 481dc7df8f72 drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
  • 1e6d07abbc0c drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
  • 22ad3edd2cec drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
  • 7445e1b85159 drm/xe: Return error on non-migratable faults requiring devmem
  • 513346701b1d drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
  • f302e5f3bd33 drm/radeon: fix r100_copy_blit for large BOs
  • 0bb004807da9 drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  • af128ca139d6 drm/i915/mtl+: Enable PPS before PLL
  • c41a54619e95 drm/i915/gem: Add missing nospec on parallel submit slot
  • bcd40ea7788f drm/displayid: fix Tiled Display Topology ID size
  • 28e1cb89f02c drm/amdkfd: Use exclusive bounds for SVM split alignment checks
  • 76e5a52855d7 drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
  • 983eb36d3b09 drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  • 9d58a811739a drm/sysfb: Avoid possible truncation with calculating visible size
  • ebbaf64d2635 drm/nouveau: fix reversed error cleanup order in ucopy functions
  • 24668ca3ec19 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
  • 9f9c88eb298c drm/amdgpu: Fix context pstate override handling
  • c5bf18ff8f2a drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
  • 73874c6d2539 drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
  • 9777453ce4f8 drm/amd/display: Restore periodic detection for DCN35
  • 34a7ed214c5e drm/xe: Add compact-PT and addr mask handling for page reclaim
  • a9a020f3c11e drm/xe/guc: Fix buffer overflow in steered register list allocation
  • e7a871390b77 drm/sysfb: Avoid truncating maximum stride
  • aed27dbfb8d6 drm/sysfb: Do not page-align visible size of the framebuffer
  • 9faf4c66edb6 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
  • efa292aebc8b drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
  • bc78482db958 drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
  • 9cd9a983769a drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
  • 51af46225f84 drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs
  • 1e9b961f9f45 drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable
  • 68a624416d1d drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
  • 4ddf82c18ee4 drm/imagination: Fit paired fragment job in the correct CCCB
  • 560adcc7d401 drm/tegra: fbdev: Remove offset into framebuffer memory
  • a6366b551079 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
  • e6ef5455b06c drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
  • ace55d80395c drm/exynos: fbdev: Remove offset into screen_buffer
  • 1f9c6b74e796 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
  • a673171502e8 drm/imagination: Count paired job fence as dependency in prepare_job()
  • ba34d197ebf2 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
  • 6d5ee0dab4f9 drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
  • 4f2352520faa drm/tidss: Fix missing drm_bridge_add() call
  • d2c08dab2738 drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
  • e299e35e86e2 drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
  • b9c8a1400a3b tracing: Fix use-after-free freeing trigger private data
  • 752b1159ed5d bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  • f1557e0a6473 LoongArch: BPF: Fix memory leak in bpf_jit_free()
  • 9aa7071185c7 pidfs: make pidfs_ino_lock static
  • d5e2cd2bc8ae drop_monitor: perform u64_stats updates under IRQ-disabled section
  • 4a9e30764e80 drop_monitor: fix size calculations for 64-bit attributes
  • 8fd6975d2aec net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  • a3829056ca98 bnge/bng_re: fix ring ID widths
  • fe9bf32bb18f tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  • ecdd0875e3bd net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  • 9e9654a8eec1 mctp: check register_netdevice_notifier() error in mctp_device_init()
  • 794c503d9264 ptp: netc: explicitly clear TMR_OFF during initialization
  • 3aa13fe0c1bb rds: tcp: unregister sysctl before tearing down listen socket
  • f08bf5f3be66 ipv6: Change allocation flags to match rcu_read_lock section requirements
  • 9fbe22b7aff0 idpf: fix max_vport related crash on allocation error during init
  • d0a21604c6ab ice: prevent tstamp ring allocation for non-PF VSI types
  • c63314c08b34 ice: fix LAG recipe to profile association
  • bff901a9852f ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
  • e3e59c37cdc2 net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
  • 294bc4b6b1a3 octeontx2-pf: tc: fix egress ratelimiting
  • f8d1c4e69ecb net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
  • d6169ed4e341 net/mlx5e: Report zero bandwidth for non-ETS traffic classes
  • 96041242efc3 net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
  • 88b2a16ddac3 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
  • 74ab1e7c8b8e raw: annotate lockless match fields in raw_v4_match()
  • 659b9b4f194b net: qrtr: restrict socket creation to the initial network namespace
  • 716cb29dbed4 LoongArch: BPF: Zero-extend signed ALU32 div/mod results
  • a189b62fa601 hinic: remove unused ethtool RSS user configuration buffers
  • daf82730355d ppp: annotate data races in ppp_generic
  • ee5b419cad37 ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
  • 6c4e18135cc0 octeontx2-vf: set TC flower flag on MCAM entry allocation
  • 9dfab50f0765 mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
  • 2bffe3790235 net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
  • c09df4d9e72e net: stmmac: enable the MAC on link up for all supported speeds
  • a99bc2eef774 net: stmmac: reset residual action in L3L4 filters on delete
  • e10ccddeec02 net: stmmac: fix l3l4 filter rejecting unsupported offload requests
  • bdcc15ec0ff7 net: stmmac: xgmac: fix l4 filter port overwrite on register update
  • 8a726e9585ff bpf: tcp: fix double sock release on batch realloc
  • ce20d589370d drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
  • c1cda72f6ace tipc: fix u16 MTU truncation in media and bearer MTU validation
  • fa1063d14a3c iomap: fix incorrect did_zero setting in iomap_zero_iter()
  • 9606c6014328 iomap: correct the range of a partial dirty clear
  • 9ac92736030f drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  • bb7abf112544 drm/xe/i2c: Allow per domain unique id
  • b28596baf87e vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
  • 83f5031f2a6a sctp: auth: verify auth requirement when auth_chunk is NULL
  • 84228811cc18 net: stmmac: dwmac4: mask interrupts when stopping DMA in suspend
  • 31f9cbd09b3c net: dpaa: fix mode setting
  • 282d220bae5f smp: Make CSD lock acquisition atomic for debug mode
  • 6455dbdbb34b smp: Avoid invalid per-CPU CSD lookup with CSD lock debug
  • ae995b8002d3 net: hsr: fix memory leak on slave unregistration by removing synced VLANs
  • 3e2ff8448333 net: bridge: vlan: fix vlan range dumps starting with pvid
  • 3741147a3d18 amt: make the head writable before rewriting the L2 header
  • 7f48e3ddad8e amt: re-read skb header pointers after every pull
  • 1f4a107439d2 ovl: check access to copy_file_range source with src mounter creds
  • 261f0a3f0ac0 drm/vc4: hvs/v3d: Fix null dereference in unbind
  • 304a470bbd62 drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A
  • ed537d090471 drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
  • 496373b64075 drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T
  • 90775605dd0f ovl: fix trusted xattr escape prefix matching
  • bd4fac033bb9 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
  • 523ed2831ee5 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
  • 45c496756c6f wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
  • 89d03bda560d wifi: mt76: mt7925: fix crash in reset link replay
  • e12575136e47 wifi: mt76: fix airoha_npu dependency tracking
  • 8bc7167e8a86 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
  • 856f1588a259 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
  • 8709c66e665a wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
  • 6f99a5667c6c wifi: mt76: mt7915: guard HE capability lookups
  • d86883f7e8f0 wifi: mt76: mt7925: guard link STA in decap offload
  • b3fe7baffc0d ppp: annotate concurrent dev->stats accesses
  • 32390b3f06f2 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
  • 42737cf1c3c9 cifs: prevent readdir from changing file size due to stale directory metadata
  • b8f3b8efa5f9 tipc: fix infinite loop in __tipc_nl_compat_dumpit
  • 18506d726376 nexthop: initialize extack in nh_res_bucket_migrate()
  • cf45d748e437 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
  • 700de4678d11 selftests: drv-net: convert so_txtime to drv-net
  • aa59787607db selftests: drv-net: increase timeout
  • e286e6145379 selftests: ovpn: increase timeout
  • 5d9e83ee4632 selftests: ovpn: add IPV6 and VETH configs
  • 20b69c478c28 selftests: openvswitch: add config file
  • 38c6b3e45ab3 selftests: af_unix: add USER_NS config
  • 8a8d80197576 tls: device: push pending open record on splice EOF
  • a40e83a34eaa net: mctp i3c: clean up notifier and buses if driver register fails
  • 00ae679cb21a sctp: validate stream count in sctp_process_strreset_inreq()
  • 02b0b8a14d87 accel: ethosu: Handle U85 internal chaining buffer
  • b4ae748f8e6c accel: ethosu: Fix element size accounting for cmd stream validation
  • 1d93c6abc147 pds_core: check for workqueue allocation failure
  • bdeab32a7a91 pds_core: fix auxiliary device add/del races
  • 6d8593349c13 pds_core: order completion reads after the ownership check
  • ac05919612b4 pds_core: yield the CPU while waiting for the adminq to drain
  • ecc7a7d7569e pds_core: fix use-after-free on workqueue during remove
  • 54f905821f26 pds_core: fix deadlock between reset thread and remove
  • b6ea3dda09eb sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
  • 4946dea23863 net: txgbe: fix FDIR filter leak on remove
  • 00d5707217b5 rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
  • febcced69581 net: txgbe: fix heap overflow when reading module EEPROM
  • d70c81001df9 tipc: serialize udp bearer replicast list updates
  • cac4ebdb831c geneve: ensure the skb is writable before fixing its headers
  • c0816ecedf36 geneve: fix hint header definition wrt endianness
  • c35b19fc3446 net: Call net_enable_timestamp() before failure in sk_clone().
  • c95ef27acc2d soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
  • 6582ba7af37d amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
  • b2f176d58dc3 arm64/mm: Check the requested PFN range during memory removal
  • 1e477e4c5e53 arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
  • 950431062159 pds_core: reject component parameter in legacy firmware update
  • d036f2d44f58 wifi: mac80211: recalculate TIM when a station enters power save
  • 0e28ca1c3204 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
  • 030a8e84f8f1 iommu/amd: Bound the early ACPI HID map
  • b6766d7ea43e wifi: mwifiex: bound uAP association event IEs to the event buffer
  • 539382822dbb wifi: mac80211: copy aggregation information
  • 0c6d1b9fbb64 vhost-net: fix TX stall when vhost owns virtio-net header
  • 2fe22d58b379 wan: wanxl: Only reset hardware after BAR mapping
  • a7dc30b6828c nfp: Check resource mutex allocation
  • 901a73523e09 wifi: mac80211: tear down new links on vif update error path
  • 02f8cefa2ad9 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
  • 4c4d866a64f3 net: airoha: Fix DMA direction for NPU mailbox buffer
  • a3cecf169cc6 dpaa2-eth: put MAC endpoint device on disconnect
  • ad28c4f9e0ea net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
  • c27694ff6748 dpaa2-switch: put MAC endpoint device on disconnect
  • 092b42cf3f60 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
  • e66451163383 gtp: parse extension headers before reading inner protocol
  • 0f8690e38691 rds: drop incoming messages that cross network namespace boundaries
  • 738039ad21e2 bonding: fix devconf_all NULL dereference when IPv6 is disabled
  • c8fd74445e86 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
  • cabfacbd5af0 bpf: Reject redirect helpers without a bpf_net_context
  • a885387dae79 net/packet: avoid fanout hook re-registration after unregister
  • 44de1031f1e2 netlink: specs: rt-link: convert bridge port flag attributes to u8
  • 08102525f1f8 selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
  • 4aba40721f92 net: phy: marvell: fix return code
  • 24b0758193d7 Bluetooth: btusb: validate Realtek vendor event length
  • 4f95592e1a90 regulator: mt6358: use regmap helper to read fixed LDO calibration
  • b042e538e98b hwmon: occ: validate poll response sensor blocks
  • 6c85bc624b4c ovpn: use monotonic clock for peer keepalive timeouts
  • 4cdb209f12a8 ovpn: fix use after free in unlock_ovpn()
  • ebe4e94f4a4c selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
  • 016a50379d17 ovpn: avoid putting unrelated P2P peer on socket release
  • 5d03046a7c53 drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight
  • 9f88a99ed511 smb: client: validate DFS referral PathConsumed
  • 672973b49ea3 hwmon: (asus-ec-sensors) add missed handle for ENOMEM
  • 491690618b90 hwmon: (asus-ec-sensors) fix EC read intervals
  • 8e609af82aa8 hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
  • 9b93a63b9087 hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers
  • 316f7140217f hwmon: (pmbus/max34440): add support adpm12250
  • aadc7e08a28a hwmon: Use named initializers for arrays of i2c_device_data
  • 734d1cb58d43 hwmon: Drop unused i2c driver_data
  • af3895e9e887 drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
  • 0cc0c4c14150 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
  • 66c87fc2d529 wifi: iwlwifi: mvm: fix read in wake packet notification handler
  • 2b348020375e wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
  • 29e89a5cd8b4 wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
  • 5bfeaeeab72e wifi: iwlwifi: mvm: validate SAR GEO response payload size
  • df61ff97d279 ASoC: cs35l56: Use complete_all() to signal init_completion
  • babdfc580020 ASoC: cs35l56: Fix potential probe() deadlock
  • ca1f96334267 arm_mpam: guard MBWU state before adding it to garbage
  • 125c3fd6b816 arm_mpam: Fix MPAMCFG_MBW_PBM register setting
  • ddc0769e2187 arm_mpam: Fix software reset values of MPAMCFG_PRI
  • 8ba157866b0c ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
  • d5dfdf43259a ALSA: hda: cs35l41: validate and free ACPI mute object
  • d90825206896 iommu/amd: Fix nested domain leak
  • e0c78cdf35af iommu/amd: Fix IRQ unsafe locking in gdom allocation
  • 10de317e64d5 ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
  • e75ef37d83c9 ASoC: tas2781: bound firmware description string parsing
  • ae0629ff9ccb btrfs: free mapping node on duplicate reloc root insert
  • 0e465c63f103 btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
  • b6ba206ffb74 btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
  • 0ea3c4445811 btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
  • 21f59906ea75 wifi: carl9170: fix buffer overflow in rx_stream failover path
  • 423c836f9348 wifi: carl9170: fix OOB read from off-by-two in TX status handler
  • cb7a38810cf2 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
  • 94e1bfcefe82 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
  • c38b0d5c6619 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
  • f8160cf19f9e wifi: ath12k: Fix low MLO RX throughput on WCN7850
  • 2a5aa4e9b892 firewire: net: Fix fragmented datagram reassembly
  • c3d2d8940ec0 platform/x86: asus-wmi: temporarily revert to setting a charge limit
  • 1e7ceb5b0135 platform/x86/intel/vsec: free ACPI discovery data on early errors
  • 8d182aead59e platform/x86/intel/vsec: allocate res with intel_vsec_dev
  • a19e0f4b6360 wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  • ef290f9e99c6 wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
  • 725c1c3a8c5d wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
  • ea48d712d298 wifi: ath10k: fix skb leak on incomplete msdu during rx pop
  • 57c3f5bd5be0 watchdog: airoha: Prevent division by zero when clock frequency is zero
  • 7993d626983c watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  • dc73b0dfeab8 hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
  • 18d7c5238910 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
  • 0842e9faab04 hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
  • 1a634f464d61 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
  • bb25bd980f2d hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
  • 4abb4e284d88 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
  • 7c9046d92c4b wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
  • 98b7fc0d7ef6 watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL
  • 828ed58535f2 selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
  • 5c350dced70b selftests/bpf: Adjust verifier_map_ptr for the map's excl field
  • 2ea73153240f usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
  • 749a36657ca2 Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
  • 845fc1e4dcf4 RISC-V: KVM: Serialize virtual interrupt pending state updates
  • abc360aac3df wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
  • 68c857b78dcc drm/amd/display: Add dp_skip_rbr flag for NUTMEG
  • f83c5af4742d drm/amd/display: Fix preferred link rate for NUTMEG
  • 95776812e6b8 drm/amd/display: Fix ISM dc_lock deadlock during suspend
  • 2d19fbfceb14 usb: typec: ucsi: Add duplicate detection to nvidia registration path
  • 244b028dc7be usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
  • c7dd73d83b8c USB: serial: option: add TDTECH MT5710-CN
  • 122f180bfc1f USB: serial: keyspan_pda: fix data loss on receive throttling
  • 1e47d8228b87 USB: serial: io_edgeport: cap received transmit credits
  • 4f411e8501d2 USB: serial: ftdi_sio: add support for E+H FXA291
  • c8510fbbea09 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
  • d4964a747171 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
  • 4c6c6a5588b9 usb: gadget: f_tcm: synchronize delayed set_alt with teardown
  • 41fd5f2fb002 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
  • 5e0eb0c78013 USB: gadget: fsl-udc: fix dev_printk() device
  • 1351277e153c USB: gadget: fsl-udc: fix device name leak on probe failure
  • 0320f21345d2 USB: gadget: snps-udc: fix device name leak on probe failure
  • e41bbbbb1740 usb: gadget: printer: fix infinite loop in printer_read()
  • ac9a51d910bb usb: gadget: f_midi: cancel pending IN work before freeing the midi object
  • e24b33618231 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
  • b4b0d3802697 usb: chipidea: fix usage_count leak when autosuspend_delay is negative
  • 2313f5e7028f USB: storage: add NO_ATA_1X quirk for Longmai USB Key
  • 6c525c851e59 usb: musb: omap2430: Do not put borrowed of_node in probe
  • e00109b5adf7 usb: core: port: Deattach Type-C connector on component unbind
  • f742d9c98b5c wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
  • ab82adf5e63b usb: core: sysfs: add lock to bos_descriptors_read()
  • 06db79411a28 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
  • 48b913e3f115 selftests: netconsole: only restore MAC when it changed on resume
  • 4e1caa5fdd0d bnxt_en: Handle partially initialized auxiliary devices
  • 3aa40c3bccac sctp: fix auth_hmacs array size in struct sctp_cookie
  • 2791a501da50 net/sched: act_tunnel_key: Defer dst_release to RCU callback
  • 4b3e6b9fdaeb dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
  • 374742a961be tcp: fix TIME_WAIT socket reference leak on PSP policy failure
  • e8fadbffc19a accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
  • 76b9ec20d22e drm/i915/selftests: Fix GT PM sort comparators
  • c7b6d61979b8 drm/i915/wm: clear the plane ddb_y entries on plane disable
  • ea128f06d2fb ksmbd: validate compound request size before reading StructureSize2
  • 14062c74e5b2 ksmbd: pin conn during async oplock break notification
  • 03d6f83979b0 drm/xe/guc: Hold device ref until queue teardown completes
  • 77fd62412431 drm/xe/guc: Keep scheduler timeline name alive
  • 5a09a0d17b6b drm/xe: Assign queue name in time for drm_sched_init
  • 82806d880eac drm/xe/wopcm: fix WOPCM size for LNL+
  • f2ebfd5cc87f drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
  • b3ea85c3c73b can: j1939: fix lockless local-destination check
  • 82f8d6ab4561 riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
  • 898bb2814f38 s390/checksum: Fix csum_partial() without vector facility
  • d4bf73b962b7 drm/panthor: Check debugfs GEM lock initialization
  • 8692655da369 bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  • 56e97b36a501 powerpc/vtime: Initialize starttime at boot for native accounting
  • 234b3ead3e8f powerpc/time: Prepare to stop elapsing in dynticks-idle
  • 21541c24563e powerpc/85xx: Add fsl,ifc to common device ids
  • 755bd5556e5f spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
  • 57791aab1129 can: raw: add locking for raw flags bitfield
  • 5fcb8b8cb396 drm/i915/gt: use correct selftest config symbol
  • ae70dda83d45 riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
  • a4a09e514283 smb/client: handle overlapping allocated ranges in fallocate
  • 3899db224f8a Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
  • 2363a7576947 Bluetooth: hci_qca: Clear memdump state on invalid dump size
  • 8d892bec1dd1 Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
  • ecdcb55ea1c0 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
  • b11511006f9e Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
  • 38326774df61 Bluetooth: hci_sync: extend conn_hash lookup critical sections
  • b82802b5ab26 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
  • 4fcfb5b2c736 Bluetooth: qca: fix NVM tag length underflow in TLV parser
  • b84691ff8069 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
  • 31e55573edeb accel/ivpu: Fix wrong register read in LNL failure diagnostics
  • 29b916d3556b ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
  • cfecc0c67619 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
  • 626aecafa69a ata: sata_dwc_460ex: use platform_get_irq()
  • 5d0797d6940b ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
  • 24d7abda6a2a scsi: core: wake eh reliably when using scsi_schedule_eh
  • 5c54e9d4fcaf udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
  • 5595ea59cdf2 net/iucv: take a reference on the socket found in afiucv_hs_rcv()
  • b8d2ea75c76a ipv4: fib: free fib_alias with kfree_rcu() on insert error path
  • 06213c85d8c0 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
  • 82e0c68e5ed4 sched_ext: Record an error on errno-only sub-enable failure
  • 4f265e2cacc6 cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
  • 14b49b5ab299 bpf: Fix UAF in sock clone early bailouts
  • 3c746522a41f firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
  • 4d8e4780e306 ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
  • 52bdf1290894 sched_ext: Enable tick for finite slices on nohz_full
  • 47370430ac16 ASoC: cs42l43: Correct report for forced microphone jack
  • b26272b392ce erofs: relax sanity check for tail pclusters due to ztailpacking
  • 70affc74bc31 ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
  • bd54a545a324 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
  • 365ea356341d ASoC: amd: ps: disable MSI on resume in ACP PCI driver
  • 46d78faf2641 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
  • 8ef18f0ab3c0 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
  • 27abdaf0c5c8 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
  • ddf2773bcc8e wifi: cfg80211: bound element ID read when checking non-inheritance
  • c73c3fc1c7ca wifi: brcmfmac: initialize SDIO data work before cleanup
  • 6d6123fef5a4 wifi: cfg80211: use wiphy work for socket owner autodisconnect
  • 4b8abf43bf34 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
  • 4e5cf3cf184c ASoC: amd: acp: Fix linker error with SDCA quirks
  • 429ac1c2fe81 wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
  • 8f2dbeee540c wifi: cfg80211: reject empty PMSR peer lists
  • 49a8ae4df3a0 wifi: cfg80211: reject unsupported PMSR FTM location requests
  • 58320cb47df2 wifi: cfg80211: validate PMSR FTM preamble range
  • befabcc4170f wifi: cfg80211: validate PMSR measurement type data
  • f3f3bbab96b3 wifi: nl80211: constrain MBSSID TX link ID range
  • f7055ad71368 wifi: nl80211: validate nested MBSSID IE blobs
  • eb1f99a02f6d wifi: cfg80211: derive S1G beacon TSF from S1G fields
  • 6f919f29e9b7 wifi: nl80211: free RNR data on MBSSID mismatch
  • 0a77d9fb4d5c wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
  • 9096e1f70141 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
  • a03fceae0c65 wifi: mac80211: defer link RX stats percpu free to RCU
  • 644640cde2fb wifi: libertas: fix memory leak in helper_firmware_cb()
  • 1981fba71797 wifi: mac80211: fix fils_discovery double free on alloc failure
  • 0ace76e410d7 wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
  • 99dc05c75acc wifi: mac80211_hwsim: clamp virtio RX length before skb_put
  • 99d2e850c643 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
  • 7cbda50eebcd wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
  • b119c70b2477 wifi: cfg80211: cancel sched scan results work on unregister
  • d91b1fdc70c5 ALSA: usb-audio: Fix imbalance per-channel volume of sticky mixers
  • 4b2c349988f9 wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack
  • 6aa3796d18a9 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
  • e078da1b4e11 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
  • ffd64e0717ef xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
  • c37a07923012 xfrm: clear mode callbacks after failed mode setup
  • bdd83f0a49a1 RDMA/irdma: Prevent overflows in memory contiguity checks
  • 1d73084f4451 selftests/alsa: Fix memory leak in find_controls error path
  • 820f983d6419 mtd: fix double free and WARN_ON in add_mtd_device() error paths
  • 52f9fcb19114 RDMA/siw: publish QP after initialization
  • 9f0fbf76d664 RDMA/hns: Fix potential integer overflow in mhop hem cleanup
  • 9d0201aefda6 RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe
  • 0d9fbcf79c72 RDMA/mana_ib: initialize err for empty send WR lists
  • a9f76f726007 RDMA/erdma: initialize ret for empty receive WR lists
  • 728211c815f6 RDMA/irdma: Prevent user-triggered null deref on QP create
  • 9b5012a9ca33 RDMA/irdma: Remove redundant legacy_mode checks
  • dbaa37e06091 RDMA/irdma: Prevent rereg_mr for non-mem regions
  • c73a1ddb21c5 RDMA/cma: Fix hardware address comparison length in netevent callback
  • 9333f4b6f448 xfrm: reject optional IPTFS templates in outbound policies
  • 96b678d08268 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
  • 6cefed45a5be reset: spacemit: k3: fix USB2 ahb reset
  • e2f188cdbf83 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  • 12a42c610e44 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
  • cb5a938ca0fe btrfs: fallback to transaction csum tree on a commit root csum miss
  • 7591d1727067 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
  • f9fef131fa3f btrfs: reject free space cache with more entries than pages
  • 0fb32ba4f74d mtd: nand: mtk-ecc: stop on ECC idle timeouts
  • 4aaba135ddf4 mtd: mtdswap: remove debugfs stats file on teardown
  • d36520e5da8b mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
  • 4d91d783f934 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
  • ad9c9ad3204f IB/mad: Drop unmatched RMPP responses before reassembly
  • bd2a4483a863 firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  • bbca7cc3b2b4 xfrm: fix stale skb->prev after async crypto steals a GSO segment
  • 0943e331500c xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
  • db2765d4bfc3 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
  • 19dd7326d1ad sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
  • b27634071289 Docs/admin-guide/cgroup-v2: fix memory.stat doc details
  • 1defa8fb132f arm64: tegra: Remove fallback compatible for GPCDMA
  • e8bfeafded96 xprtrdma: Clear receive-side ownership pointers on release
  • 9382304e25c6 crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
  • b773faa32b0a gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
  • 43cfb20d62ff KVM: x86/mmu: Fix use-after-free on vendor module reload
  • 1dabef6e2065 KVM: nVMX: Hide shadow VMCS right after VMCLEAR
  • 6e9815aa51fc KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
  • bce0d3c26e2c KVM: x86: Check for invalid/obsolete root after making MMU pages available
  • 29ca543ac55a seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
  • 2e0b1d51de9e drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
  • 1d412720a163 sched_ext: Skip ops.set_weight() for disabled tasks
  • 782e1042143d platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
View original

Upgraded? How did it go?

Discussion