6.6.90-rc2 review

This is the start of the stable review cycle for the 6.6.90 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 10 May 2025 11:25:47 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.90-rc2.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.90-rc2

Tudor Ambarus <[email protected]>
dm: fix copying after src array boundaries

Mathias Nyman <[email protected]>
xhci: fix possible null pointer dereference at secondary interrupter removal

Marc Zyngier <[email protected]>

    usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup()

Chris Bainbridge <[email protected]>
drm/amd/display: Fix slab-use-after-free in hdcp

Mario Limonciello <[email protected]>
drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp

Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids

Jason Gunthorpe <[email protected]>
iommu/arm-smmu-v3: Use the new rb tree helpers

Shyam Saini <[email protected]>
drivers: base: handle module_kobject creation

Shyam Saini <[email protected]>
kernel: globalize lookup_or_create_module_kobject()

Shyam Saini <[email protected]>
kernel: param: rename locate_module_kobject

Björn Töpel <[email protected]>
riscv: uprobes: Add missing fence.i after building the XOL buffer

Mathias Nyman <[email protected]>
xhci: Limit time spent with xHC interrupts disabled during bus resume

Mathias Nyman <[email protected]>
xhci: support setting interrupt moderation IMOD for secondary interrupters

Niklas Neronin <[email protected]>
usb: xhci: check if 'requested segments' exceeds ERST capacity

Mathias Nyman <[email protected]>
xhci: Add helper to set an interrupters interrupt moderation interval

Mathias Nyman <[email protected]>
xhci: add support to allocate several interrupters

Mathias Nyman <[email protected]>
xhci: split free interrupter into separate remove and free parts

Lukas Wunner <[email protected]>
xhci: Clean up stale comment on ERST_SIZE macro

Jonathan Bell <[email protected]>
xhci: Use more than one Event Ring segment

Lukas Wunner <[email protected]>
xhci: Set DESI bits in ERDP register correctly

Christian Hewitt <[email protected]>
Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"

Christian Bruel <[email protected]>
arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs

Christian Bruel <[email protected]>
arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs

Sébastien Szymanski <[email protected]>
ARM: dts: opos6ul: add ksz8081 phy properties

Sudeep Holla <[email protected]>
firmware: arm_ffa: Skip Rx buffer ownership release if not acquired

Cristian Marussi <[email protected]>
firmware: arm_scmi: Balance device refcount when destroying devices

Cong Wang <[email protected]>
sch_ets: make est_qlen_notify() idempotent

Cong Wang <[email protected]>
sch_qfq: make qfq_qlen_notify() idempotent

Cong Wang <[email protected]>
sch_hfsc: make hfsc_qlen_notify() idempotent

Cong Wang <[email protected]>
sch_drr: make drr_qlen_notify() idempotent

Cong Wang <[email protected]>
sch_htb: make htb_qlen_notify() idempotent

Samuel Holland <[email protected]>
riscv: Pass patch_text() the length in bytes

Geert Uytterhoeven <[email protected]>
ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties

Rob Herring (Arm) <[email protected]>
ASoC: Use of_property_read_bool()

Stefan Wahren <[email protected]>
net: vertexcom: mse102x: Fix RX error handling

Stefan Wahren <[email protected]>
net: vertexcom: mse102x: Add range check for CMD_RTS

Stefan Wahren <[email protected]>
net: vertexcom: mse102x: Fix LEN_MASK

Stefan Wahren <[email protected]>
net: vertexcom: mse102x: Fix possible stuck of SPI interrupt

Jian Shen <[email protected]>
net: hns3: defer calling ptp_clock_register()

Hao Lan <[email protected]>
net: hns3: fixed debugfs tm_qset size

Yonglong Liu <[email protected]>
net: hns3: fix an interrupt residual problem

Jian Shen <[email protected]>
net: hns3: store rx VLAN tag offload state for VF

Sathesh B Edara <[email protected]>
octeon_ep: Fix host hang issue during device reboot

Mattias Barthel <[email protected]>
net: fec: ERR007885 Workaround for conventional TX

Thangaraj Samynathan <[email protected]>
net: lan743x: Fix memleak issue when GSO enabled

Michael Liang <[email protected]>
nvme-tcp: fix premature queue removal and I/O failover

Michael Chan <[email protected]>
bnxt_en: Fix ethtool -d byte order for 32-bit values

Shruti Parab <[email protected]>
bnxt_en: Fix out-of-bound memcpy() during ethtool -w

Shruti Parab <[email protected]>
bnxt_en: Fix coredump logic to free allocated buffer

Felix Fietkau <[email protected]>
net: ipv6: fix UDPv6 GSO segmentation with NAT

Vladimir Oltean <[email protected]>
net: dsa: felix: fix broken taprio gate states after clock jump

Chad Monroe <[email protected]>
net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

Jacob Keller <[email protected]>
igc: fix lock order in igc_ptp_reset

Da Xue <[email protected]>
net: mdio: mux-meson-gxl: set reversed bit when using internal phy

Simon Horman <[email protected]>
net: dlink: Correct endianness handling of led_mode

Keith Busch <[email protected]>
nvme-pci: fix queue unquiesce check on slot_reset

Takashi Iwai <[email protected]>
ALSA: ump: Fix buffer overflow at UMP SysEx message conversion

Xuanqiang Luo <[email protected]>
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()

Victor Nogueira <[email protected]>
net_sched: qfq: Fix double list add in class with netem as child qdisc

Victor Nogueira <[email protected]>
net_sched: ets: Fix double list add in class with netem as child qdisc

Victor Nogueira <[email protected]>
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

Victor Nogueira <[email protected]>
net_sched: drr: Fix double list add in class with netem as child qdisc

Shannon Nelson <[email protected]>
pds_core: remove write-after-free of client_id

Shannon Nelson <[email protected]>
pds_core: specify auxiliary_device to be created

Shannon Nelson <[email protected]>
pds_core: make pdsc_auxbus_dev_del() void

Shannon Nelson <[email protected]>
pds_core: delete VF dev on reset

Shannon Nelson <[email protected]>
pds_core: check health in devcmd wait

Louis-Alexis Eyraud <[email protected]>
net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised

Louis-Alexis Eyraud <[email protected]>
net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll

Vladimir Oltean <[email protected]>
net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID

Vladimir Oltean <[email protected]>
net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged

Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: copy RX timestamp to new fragments

Abhishek Chauhan <[email protected]>
net: Rename mono_delivery_time to tstamp_type for scalabilty

En-Wei Wu <[email protected]>
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

Chris Mi <[email protected]>
net/mlx5: E-switch, Fix error handling for enabling roce

Maor Gottlieb <[email protected]>
net/mlx5: E-Switch, Initialize MAC Address for Default GID

Ido Schimmel <[email protected]>
vxlan: vnifilter: Fix unlocked deletion of default FDB entry

Madhavan Srinivasan <[email protected]>
powerpc/boot: Fix dash warning

Murad Masimov <[email protected]>
wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release

Chen Linxuan <[email protected]>
drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions'

Madhavan Srinivasan <[email protected]>
powerpc/boot: Check for ld-option support

Donet Tom <[email protected]>
book3s64/radix : Align section vmemmap start address to PAGE_SIZE

Sheetal <[email protected]>
ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence

Robin Murphy <[email protected]>
iommu: Handle race with default domain setup

Sean Christopherson <[email protected]>
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Richard Zhu <[email protected]>
PCI: imx6: Skip controller_id generation logic for i.MX7D

Ryan Matthews <[email protected]>
Revert "PCI: imx6: Skip controller_id generation logic for i.MX7D"

Eduard Zingerman <[email protected]>
selftests/bpf: extend changes_pkt_data with cases w/o subprograms

Eduard Zingerman <[email protected]>
bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs

Eduard Zingerman <[email protected]>
selftests/bpf: validate that tail call invalidates packet pointers

Eduard Zingerman <[email protected]>
bpf: consider that tail calls invalidate packet pointers

Eduard Zingerman <[email protected]>
selftests/bpf: freplace tests for tracking of changes_packet_data

Eduard Zingerman <[email protected]>
bpf: check changes_pkt_data property for extension programs

Eduard Zingerman <[email protected]>
selftests/bpf: test for changing packet data from global functions

Eduard Zingerman <[email protected]>
bpf: track changes_pkt_data property for global functions

Eduard Zingerman <[email protected]>
bpf: refactor bpf_helper_changes_pkt_data to use helper number

Eduard Zingerman <[email protected]>
bpf: add find_containing_subprog() utility function

Jeongjun Park <[email protected]>
tracing: Fix oob write in trace_seq_to_buffer()

Rafael J. Wysocki <[email protected]>
cpufreq: Fix setting policy limits when frequency tables are used

Rafael J. Wysocki <[email protected]>

    cpufreq: Avoid using inconsistent policy->min and policy->max

Jethro Donaldson <[email protected]>
smb: client: fix zero length for mkdir POSIX create context

Sean Heelan <[email protected]>
ksmbd: fix use-after-free in kerberos authentication

Shouye Liu <[email protected]>
platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug

Mario Limonciello <[email protected]>
platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles

Mingcong Bai <[email protected]>

    iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)

Pavel Paklov <[email protected]>
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid

Benjamin Marzinski <[email protected]>
dm: always update the array size in realloc_argv on success

Mikulas Patocka <[email protected]>
dm-integrity: fix a warning on invalid table line

LongPing Wei <[email protected]>
dm-bufio: don't schedule in atomic context

Wentao Liang <[email protected]>
wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()

Steven Rostedt <[email protected]>
tracing: Do not take trace_event_sem in print_event_fields()

Aaron Kling <[email protected]>
spi: tegra114: Don't fail set_cs_timing when delays are zero

Ruslan Piasetskyi <[email protected]>
mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe

Wei Yang <[email protected]>
mm/memblock: repeat setting reserved region nid if array is doubled

Wei Yang <[email protected]>
mm/memblock: pass size instead of end to memblock_set_node()

Stephan Gerhold <[email protected]>
irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs

Vishal Badole <[email protected]>
amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload

Sean Christopherson <[email protected]>
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.

Helge Deller <[email protected]>
parisc: Fix double SIGFPE crash

Will Deacon <[email protected]>
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays

Clark Wang <[email protected]>
i2c: imx-lpi2c: Fix clock count when probe defers

Niravkumar L Rabara <[email protected]>
EDAC/altera: Set DDR and SDMMC interrupt mask before registration

Niravkumar L Rabara <[email protected]>
EDAC/altera: Test the correct error reg offset

Philipp Stanner <[email protected]>
drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()

Tvrtko Ursulin <[email protected]>
drm/fdinfo: Protect against driver unbind

Dave Chen <[email protected]>
btrfs: fix COW handling in run_delalloc_nocow()

Joachim Priesner <[email protected]>
ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset

Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()

Christian Heusel <[email protected]>
Revert "rndis_host: Flag RNDIS modems as WWAN devices"

-------------

Diffstat:

 Makefile                                           |   4 +-
 .../boot/dts/nxp/imx/imx6ul-imx6ull-opos6ul.dtsi   |   3 +
 arch/arm64/boot/dts/st/stm32mp251.dtsi             |   9 +-
 arch/arm64/kernel/proton-pack.c                    |   2 +
 arch/parisc/math-emu/driver.c                      |  16 +-
 arch/powerpc/boot/wrapper                          |   6 +-
 arch/powerpc/mm/book3s64/radix_pgtable.c           |  17 +-
 arch/riscv/include/asm/patch.h                     |   2 +-
 arch/riscv/kernel/patch.c                          |  14 +-
 arch/riscv/kernel/probes/kprobes.c                 |  18 +-
 arch/riscv/kernel/probes/uprobes.c                 |  10 +-
 arch/riscv/net/bpf_jit_comp64.c                    |   7 +-
 arch/x86/events/intel/core.c                       |   2 +-
 arch/x86/include/asm/kvm-x86-ops.h                 |   1 +
 arch/x86/include/asm/kvm_host.h                    |   1 +
 arch/x86/kvm/svm/svm.c                             |  13 +-
 arch/x86/kvm/vmx/vmx.c                             |  11 +-
 arch/x86/kvm/x86.c                                 |   3 +
 drivers/base/module.c                              |  13 +-
 drivers/bluetooth/btusb.c                          | 101 ++++++++---
 drivers/cpufreq/cpufreq.c                          |  42 ++++-
 drivers/cpufreq/cpufreq_ondemand.c                 |   3 +-
 drivers/cpufreq/freq_table.c                       |   6 +-
 drivers/edac/altera_edac.c                         |   9 +-
 drivers/edac/altera_edac.h                         |   2 +
 drivers/firmware/arm_ffa/driver.c                  |   3 +-
 drivers/firmware/arm_scmi/bus.c                    |   3 +
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c |  56 +++---
 drivers/gpu/drm/drm_file.c                         |   6 +
 drivers/gpu/drm/i915/pxp/intel_pxp_gsccs.h         |   8 +-
 drivers/gpu/drm/meson/meson_vclk.c                 |   6 +-
 drivers/gpu/drm/nouveau/nouveau_fence.c            |   2 +-
 drivers/i2c/busses/i2c-imx-lpi2c.c                 |   4 +-
 drivers/iommu/amd/init.c                           |   8 +
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |  79 +++++----
 drivers/iommu/intel/iommu.c                        |   4 +-
 drivers/iommu/iommu.c                              |  18 ++
 drivers/irqchip/irq-qcom-mpm.c                     |   3 +
 drivers/md/dm-bufio.c                              |   9 +-
 drivers/md/dm-integrity.c                          |   2 +-
 drivers/md/dm-table.c                              |   5 +-
 drivers/mmc/host/renesas_sdhi_core.c               |  10 +-
 drivers/net/dsa/ocelot/felix_vsc9959.c             |   5 +-
 drivers/net/ethernet/amd/pds_core/auxbus.c         |  49 +++---
 drivers/net/ethernet/amd/pds_core/core.h           |   7 +-
 drivers/net/ethernet/amd/pds_core/dev.c            |  11 +-
 drivers/net/ethernet/amd/pds_core/devlink.c        |   7 +-
 drivers/net/ethernet/amd/pds_core/main.c           |  23 ++-
 drivers/net/ethernet/amd/xgbe/xgbe-desc.c          |   9 +-
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c           |  24 ++-
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c           |  11 +-
 drivers/net/ethernet/amd/xgbe/xgbe.h               |   4 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c |  30 ++--
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c  |  36 +++-
 drivers/net/ethernet/dlink/dl2k.c                  |   2 +-
 drivers/net/ethernet/dlink/dl2k.h                  |   2 +-
 drivers/net/ethernet/freescale/fec_main.c          |   7 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c |   2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |  82 +++++----
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c |  13 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  |  25 ++-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h  |   1 +
 drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c |   5 +
 drivers/net/ethernet/intel/igc/igc_ptp.c           |   6 +-
 .../net/ethernet/marvell/octeon_ep/octep_main.c    |   2 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |  14 +-
 drivers/net/ethernet/mediatek/mtk_star_emac.c      |  13 +-
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/rdma.c     |  11 +-
 drivers/net/ethernet/mellanox/mlx5/core/rdma.h     |   4 +-
 drivers/net/ethernet/microchip/lan743x_main.c      |   8 +-
 drivers/net/ethernet/microchip/lan743x_main.h      |   1 +
 drivers/net/ethernet/mscc/ocelot.c                 | 194 +++++++++++++++++++--
 drivers/net/ethernet/mscc/ocelot_vcap.c            |   1 +
 drivers/net/ethernet/vertexcom/mse102x.c           |  36 +++-
 drivers/net/mdio/mdio-mux-meson-gxl.c              |   3 +-
 drivers/net/usb/rndis_host.c                       |  16 +-
 drivers/net/vxlan/vxlan_vnifilter.c                |   8 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |   6 +-
 drivers/net/wireless/purelifi/plfxlc/mac.c         |   1 -
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvme/host/tcp.c                            |  31 +++-
 drivers/pci/controller/dwc/pci-imx6.c              |   3 +-
 drivers/platform/x86/amd/pmc/pmc.c                 |   7 +-
 .../x86/intel/uncore-frequency/uncore-frequency.c  |  13 +-
 drivers/spi/spi-tegra114.c                         |   6 +-
 drivers/usb/host/xhci-debugfs.c                    |   2 +-
 drivers/usb/host/xhci-hub.c                        |  30 ++--
 drivers/usb/host/xhci-mem.c                        | 175 +++++++++++++++----
 drivers/usb/host/xhci-ring.c                       |   4 +-
 drivers/usb/host/xhci.c                            |  80 ++++++---
 drivers/usb/host/xhci.h                            |  20 ++-
 fs/btrfs/inode.c                                   |   9 +-
 fs/smb/client/smb2pdu.c                            |   1 +
 fs/smb/server/auth.c                               |  14 +-
 fs/smb/server/smb2pdu.c                            |   5 -
 include/linux/bpf.h                                |   1 +
 include/linux/bpf_verifier.h                       |   1 +
 include/linux/cpufreq.h                            |  83 ++++++---
 include/linux/filter.h                             |   2 +-
 include/linux/module.h                             |   2 +
 include/linux/pds/pds_core_if.h                    |   1 +
 include/linux/skbuff.h                             |  52 ++++--
 include/net/inet_frag.h                            |   4 +-
 include/soc/mscc/ocelot_vcap.h                     |   2 +
 include/sound/ump_convert.h                        |   2 +-
 kernel/bpf/core.c                                  |   2 +-
 kernel/bpf/verifier.c                              |  81 +++++++--
 kernel/params.c                                    |   6 +-
 kernel/trace/trace.c                               |   5 +-
 kernel/trace/trace_output.c                        |   4 +-
 mm/memblock.c                                      |  12 +-
 net/bluetooth/l2cap_core.c                         |   3 +
 net/bridge/netfilter/nf_conntrack_bridge.c         |   6 +-
 net/core/dev.c                                     |   2 +-
 net/core/filter.c                                  |  73 ++++----
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/inet_fragment.c                           |   2 +-
 net/ipv4/ip_fragment.c                             |   2 +-
 net/ipv4/ip_output.c                               |   9 +-
 net/ipv4/tcp_output.c                              |  14 +-
 net/ipv4/udp_offload.c                             |  61 ++++++-
 net/ipv6/ip6_output.c                              |   6 +-
 net/ipv6/netfilter.c                               |   6 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |   2 +-
 net/ipv6/reassembly.c                              |   2 +-
 net/ipv6/tcp_ipv6.c                                |   2 +-
 net/sched/act_bpf.c                                |   4 +-
 net/sched/cls_bpf.c                                |   4 +-
 net/sched/sch_drr.c                                |  16 +-
 net/sched/sch_ets.c                                |  17 +-
 net/sched/sch_hfsc.c                               |  10 +-
 net/sched/sch_htb.c                                |   2 +
 net/sched/sch_qfq.c                                |  18 +-
 sound/soc/codecs/ak4613.c                          |   4 +-
 sound/soc/soc-core.c                               |  36 ++--
 sound/soc/soc-pcm.c                                |   5 +-
 sound/usb/endpoint.c                               |   7 +
 sound/usb/format.c                                 |   3 +-
 .../selftests/bpf/prog_tests/changes_pkt_data.c    | 107 ++++++++++++
 .../testing/selftests/bpf/progs/changes_pkt_data.c |  39 +++++
 .../bpf/progs/changes_pkt_data_freplace.c          |  18 ++
 tools/testing/selftests/bpf/progs/verifier_sock.c  |  56 ++++++
 143 files changed, 1763 insertions(+), 662 deletions(-)