Linux 6.6.110

DISCUSSION Greg Kroah-Hartman 1 participant 2 messages Oct 6, 2025 Stable branch

lore

Share & tools

lore

Greg Kroah-Hartman

author maintainer

2025-10-06 09:56 UTC #0 lore raw

I'm announcing the release of the 6.6.110 kernel.

All users of the 6.6 kernel series must upgrade.

The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 drivers/media/pci/b2c2/flexcop-pci.c  |    2 
 drivers/media/rc/imon.c               |   27 +++++++++---
 drivers/media/usb/uvc/uvc_driver.c    |   73 +++++++++++++++++++++-------------
 drivers/media/usb/uvc/uvcvideo.h      |    2 
 drivers/target/target_core_configfs.c |    2 
 include/crypto/sha256_base.h          |    2 
 scripts/gcc-plugins/gcc-common.h      |    7 +++
 sound/soc/qcom/qdsp6/topology.c       |    4 -
 9 files changed, 81 insertions(+), 40 deletions(-)

Breno Leitao (1):
crypto: sha256 - fix crash at kexec

Duoming Zhou (1):
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove

Greg Kroah-Hartman (1):

      Linux 6.6.110

Kees Cook (1):
gcc-plugins: Remove TODO_verify_il for GCC >= 16

Larshin Sergey (1):
media: rc: fix races with imon_disconnect()

Srinivas Kandagatla (1):
ASoC: qcom: audioreach: fix potential null pointer dereference

Thadeu Lima de Souza Cascardo (1):
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID

Wang Haoran (1):
scsi: target: target_core_configfs: Add length check to avoid buffer overflow

Greg Kroah-Hartman

author maintainer

2025-10-06 09:56 UTC #1 lore raw

Makefile +1 -1

index afeacf5efc95..196343089737 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 6
-SUBLEVEL = 109
+SUBLEVEL = 110
 EXTRAVERSION =
 NAME = Pinguïn Aangedreven

drivers/media/pci/b2c2/flexcop-pci.c +1 -1

index 486c8ec0fa60..ab53c5b02c48 100644
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pci_dev *pdev)
 	struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
 
 	if (irq_chk_intv > 0)
-		cancel_delayed_work(&fc_pci->irq_check_work);
+		cancel_delayed_work_sync(&fc_pci->irq_check_work);
 
 	flexcop_pci_dma_exit(fc_pci);
 	flexcop_device_exit(fc_pci->fc_dev);

drivers/media/rc/imon.c +20 -7

index e5590a708f1c..f4deca8894e0 100644
@@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file)
 
 	mutex_lock(&ictx->lock);
 
-	if (!ictx->display_supported) {
+	if (ictx->disconnected) {
+		retval = -ENODEV;
+	} else if (!ictx->display_supported) {
 		pr_err("display not supported by device\n");
 		retval = -ENODEV;
 	} else if (ictx->display_isopen) {

@@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx)
 	int retval = 0;
 	struct usb_ctrlrequest *control_req = NULL;
 
+	if (ictx->disconnected)
+		return -ENODEV;
+
 	/* Check if we need to use control or interrupt urb */
 	if (!ictx->tx_control) {
 		pipe = usb_sndintpipe(ictx->usbdev_intf0,

@@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
 	static const unsigned char vfd_packet6[] = {
 		0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF };
 
-	if (ictx->disconnected)
-		return -ENODEV;
-
 	if (mutex_lock_interruptible(&ictx->lock))
 		return -ERESTARTSYS;
 
+	if (ictx->disconnected) {
+		retval = -ENODEV;
+		goto exit;
+	}
+
 	if (!ictx->dev_present_intf0) {
 		pr_err_ratelimited("no iMON device present\n");
 		retval = -ENODEV;

@@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf,
 	int retval = 0;
 	struct imon_context *ictx = file->private_data;
 
-	if (ictx->disconnected)
-		return -ENODEV;
-
 	mutex_lock(&ictx->lock);
 
+	if (ictx->disconnected) {
+		retval = -ENODEV;
+		goto exit;
+	}
+
 	if (!ictx->display_supported) {
 		pr_err_ratelimited("no iMON display present\n");
 		retval = -ENODEV;

@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface)
 	int ifnum;
 
 	ictx = usb_get_intfdata(interface);
+
+	mutex_lock(&ictx->lock);
 	ictx->disconnected = true;
+	mutex_unlock(&ictx->lock);
+
 	dev = ictx->dev;
 	ifnum = interface->cur_altsetting->desc.bInterfaceNumber;

drivers/media/usb/uvc/uvc_driver.c +46 ~~-27~~

139 lines not on this page · raw message

drivers/media/usb/uvc/uvcvideo.h +2 -0

index e99bfaa62266..cbb5ce963cd0 100644
@@ -41,6 +41,8 @@
 #define UVC_EXT_GPIO_UNIT		0x7ffe
 #define UVC_EXT_GPIO_UNIT_ID		0x100
 
+#define UVC_INVALID_ENTITY_ID          0xffff
+
 /* ------------------------------------------------------------------------
  * Driver specific constants.
  */

drivers/target/target_core_configfs.c +1 -1

index 9a88774836c9..eddcfd09c05b 100644
@@ -2738,7 +2738,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page)
 			config_item_name(&dev->dev_group.cg_item));
 		cur_len++; /* Extra byte for NULL terminator */
 
-		if ((cur_len + len) > PAGE_SIZE) {
+		if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) {
 			pr_warn("Ran out of lu_gp_show_attr"
 				"_members buffer\n");
 			break;

include/crypto/sha256_base.h +1 -1

index ab904d82236f..0f5f3a6f79f0 100644
@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx,
 	sctx->count += len;
 
 	if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) {
-		int blocks;
+		unsigned int blocks;
 
 		if (partial) {
 			int p = SHA256_BLOCK_SIZE - partial;

scripts/gcc-plugins/gcc-common.h +7 -0

index 90e83d62adb5..de1e4c927cbc 100644
@@ -196,10 +196,17 @@ inline bool is_a_helper<const gassign *>::test(const_gimple gs)
 }
 #endif
 
+#if BUILDING_GCC_VERSION < 16000
 #define TODO_verify_ssa TODO_verify_il
 #define TODO_verify_flow TODO_verify_il
 #define TODO_verify_stmts TODO_verify_il
 #define TODO_verify_rtl_sharing TODO_verify_il
+#else
+#define TODO_verify_ssa 0
+#define TODO_verify_flow 0
+#define TODO_verify_stmts 0
+#define TODO_verify_rtl_sharing 0
+#endif
 
 #define INSN_DELETED_P(insn) (insn)->deleted()

sound/soc/qcom/qdsp6/topology.c +2 -2

index 70572c83e101..d4c3bc85fb35 100644
@@ -586,8 +586,8 @@ static int audioreach_widget_load_module_common(struct snd_soc_component *compon
 		return PTR_ERR(cont);
 
 	mod = audioreach_parse_common_tokens(apm, cont, &tplg_w->priv, w);
-	if (IS_ERR(mod))
-		return PTR_ERR(mod);
+	if (IS_ERR_OR_NULL(mod))
+		return mod ? PTR_ERR(mod) : -ENODEV;
 
 	dobj = &w->dobj;
 	dobj->private = mod;