6.6.105-rc2 review

This is the start of the stable review cycle for the 6.6.105 release. There are 118 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 10 Sep 2025 15:18:22 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.105-rc2.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.105-rc2

Kevin Hao <[email protected]>
spi: fsl-qspi: Fix double cleanup in probe error path

Qiu-ji Chen <[email protected]>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo()

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE()

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo()

Radim Krčmář <[email protected]>
riscv: use lw when reading int cpu in asm_per_cpu

yangshiguang <[email protected]>
mm: slub: avoid wake up kswapd in set_track_prepare

Chengming Zhou <[email protected]>
slub: Reflow ___slab_alloc()

zhang jiao <[email protected]>
tools: gpio: remove the include directory on make clean

zhangjiao <[email protected]>
tools: gpio: rm .*.cmd on make clean

Colin Ian King <[email protected]>
drm/amd/amdgpu: Fix missing error return on kzalloc failure

Hawking Zhang <[email protected]>
drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c

Ian Rogers <[email protected]>
perf bpf-event: Fix use-after-free in synthesis

Michael Walle <[email protected]>
drm/bridge: ti-sn65dsi86: fix REFCLK setting

Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Clear status register after disabling the module

Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort

Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit

Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Fix transmissions when using CONT

Vadim Pasternak <[email protected]>
hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM

Wentao Liang <[email protected]>
pcmcia: Add error handling for add_interval() in do_validate_mem()

Chen Ni <[email protected]>
pcmcia: omap: Add missing check for platform_get_resource

Alex Deucher <[email protected]>
Revert "drm/amdgpu: Avoid extra evict-restore process."

Aaron Erhardt <[email protected]>
ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY

Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model

Ma Ke <[email protected]>
drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv

Jason-JH.Lin <[email protected]>
drm/mediatek: Fix using wrong drm private data to bind mediatek-drm

Jason-JH.Lin <[email protected]>
drm/mediatek: Add crtc path enum for all_drm_priv array

Ronak Doshi <[email protected]>
vmxnet3: update MTU after device quiesce

Jakob Unterwurzacher <[email protected]>
net: dsa: microchip: linearize skb for tail-tagging switches

Pieter Van Trappen <[email protected]>
net: dsa: microchip: update tag_ksz masks for KSZ9477 family

Qiu-ji Chen <[email protected]>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()

Chris Chiu <[email protected]>
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup

Stefan Binding <[email protected]>
ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA

David Lechner <[email protected]>
iio: pressure: mprls0025pa: use aligned_s64 for timestamp

Luca Ceresoli <[email protected]>
iio: light: opt3001: fix deadlock due to concurrent flag access

David Lechner <[email protected]>
iio: chemical: pms7003: use aligned_s64 for timestamp

David Lechner <[email protected]>
iio: imu: inv_mpu6050: align buffer for timestamp

Josef Bacik <[email protected]>
btrfs: adjust subpage bit start based on sectorsize

Jonathan Currier <[email protected]>
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads

Nícolas F. R. A. Prado <[email protected]>
thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold

Han Xu <[email protected]>
spi: fsl-qspi: use devm function instead of driver remove

Li Qiong <[email protected]>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()

Dave Airlie <[email protected]>
nouveau: fix disabling the nonstall irq due to storm code

Srinivas Pandruvada <[email protected]>
cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller

Srinivas Pandruvada <[email protected]>
cpufreq: intel_pstate: Revise global turbo disable check

Jinfeng Wang <[email protected]>
Revert "spi: spi-cadence-quadspi: Fix pm runtime unbalance"

Jinfeng Wang <[email protected]>
Revert "spi: cadence-quadspi: fix cleanup of rx_chan on failure paths"

Lad Prabhakar <[email protected]>
net: pcs: rzn1-miic: Correct MODCTRL register offset

Vitaly Lifshits <[email protected]>
e1000e: fix heap overflow in e1000_set_eeprom

Makar Semyonov <[email protected]>
cifs: prevent NULL pointer dereference in UTF16 conversion

Stanislav Fort <[email protected]>
batman-adv: fix OOB read/write in network-coding decode

John Evans <[email protected]>
scsi: lpfc: Fix buffer free/clear order in deferred receive path

Christoffer Sandberg <[email protected]>
platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list

Alex Deucher <[email protected]>
drm/amdgpu: drop hw access in non-DC audio fini

Nathan Chancellor <[email protected]>
wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()

Qianfeng Rong <[email protected]>
wifi: mwifiex: Initialize the chan_stats array to zero

Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Deal with zero e_shentsize

wangzijie <[email protected]>
proc: fix missing pde_set_flags() for net proc files

Edward Adam Davis <[email protected]>
ocfs2: prevent release journal inode after journal shutdown

Christian Loehle <[email protected]>
sched: Fix sched_numa_find_nth_cpu() if mask offline

Harry Yoo <[email protected]>
mm: move page table sync declarations to linux/pgtable.h

Harry Yoo <[email protected]>
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()

Ma Ke <[email protected]>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()

panfan <[email protected]>
arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE

Miaoqian Lin <[email protected]>
ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()

Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices

Horatiu Vultur <[email protected]>
phy: mscc: Stop taking ts_lock for tx_queue and use its own lock

Kuniyuki Iwashima <[email protected]>
selftest: net: Fix weird setsockopt() in bind_bhash.c.

Qingfang Deng <[email protected]>
ppp: fix memory leak in pad_compress_skb

Wang Liang <[email protected]>
net: atm: fix memory leak in atm_register_sysfs when device_register fail

Eric Dumazet <[email protected]>
ax25: properly unshare skbs in ax25_kiss_rcv()

Alok Tiwari <[email protected]>
mctp: return -ENOPROTOOPT for unknown getsockopt options

Mahanta Jambigi <[email protected]>
net/smc: Remove validation of reserved bits in CLC Decline message

Dan Carpenter <[email protected]>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()

Rosen Penev <[email protected]>
net: thunder_bgx: decrement cleanup index before use

Rosen Penev <[email protected]>
net: thunder_bgx: add a missing of_node_put

Dan Carpenter <[email protected]>

    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

Dan Carpenter <[email protected]>
wifi: libertas: cap SSID len in lbs_associate()

Dan Carpenter <[email protected]>

    wifi: cw1200: cap SSID length in cw1200_do_join()

Felix Fietkau <[email protected]>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets

Rameshkumar Sundaram <[email protected]>
wifi: ath11k: fix group data packet drops during rekey

Baochen Qiang <[email protected]>
wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()

Baochen Qiang <[email protected]>
wifi: ath11k: rename ath11k_start_vdev_delay()

Jeff Johnson <[email protected]>
wifi: ath11k: Introduce and use ath11k_sta_to_arsta()

Zhen Ni <[email protected]>
i40e: Fix potential invalid access when MAC list is empty

Liu Jian <[email protected]>
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

Sabrina Dubroca <[email protected]>
macsec: read MACSEC_SA_ATTR_PN with nla_get_uint

Jakub Kicinski <[email protected]>
netlink: add variable-length / auto integers

Sean Anderson <[email protected]>
net: macb: Fix tx_ptr_lock locking

Fabian Bläse <[email protected]>
icmp: fix icmp_ndo_send address translation for reply direction

Miaoqian Lin <[email protected]>
mISDN: Fix memory leak in dsp_hwec_enable()

Alok Tiwari <[email protected]>
xirc2ps_cs: fix register access when enabling FullDuplex

Kuniyuki Iwashima <[email protected]>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

Ivan Pravdin <[email protected]>
Bluetooth: vhci: Prevent use-after-free by removing debugfs files early

Phil Sutter <[email protected]>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY

Wang Liang <[email protected]>
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

Duoming Zhou <[email protected]>
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

Dmitry Antipov <[email protected]>

    wifi: cfg80211: fix use-after-free in cmp_bss()

Marek Vasut <[email protected]>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC

Marek Vasut <[email protected]>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM

Sungbae Yoo <[email protected]>
tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"

Peter Robinson <[email protected]>
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro

Pei Xiao <[email protected]>
tee: fix NULL pointer dereference in tee_shm_put

Jiufei Xue <[email protected]>
fs: writeback: fix use-after-free in __mark_inode_dirty()

Yang Li <[email protected]>
Bluetooth: hci_sync: Avoid adding default advertising on startup

Shinji Nomoto <[email protected]>
cpupower: Fix a bug where the -t option of the set subcommand was not working.

Timur Kristóf <[email protected]>
drm/amd/display: Don't warn when missing DCE encoder caps

Lubomir Rintel <[email protected]>
cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN

Huacai Chen <[email protected]>
LoongArch: Save LBT before FPU in setup_sigcontext()

Filipe Manana <[email protected]>
btrfs: avoid load/store tearing races when checking if an inode was logged

Filipe Manana <[email protected]>
btrfs: fix race between setting last_dir_index_offset and inode logging

Filipe Manana <[email protected]>
btrfs: fix race between logging inode and checking if it was logged before

Daniel Borkmann <[email protected]>
bpf: Fix oob access in cgroup local storage

Daniel Borkmann <[email protected]>
bpf: Move bpf map owner out of common struct

Daniel Borkmann <[email protected]>
bpf: Move cgroup iterator helpers to bpf.h

Daniel Borkmann <[email protected]>
bpf: Add cookie object to bpf maps

-------------

Diffstat:

 Documentation/userspace-api/netlink/specs.rst      |  18 +-
 Makefile                                           |   4 +-
 .../dts/freescale/imx8mp-data-modul-edm-sbc.dts    |   1 +
 .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi |   1 +
 .../boot/dts/rockchip/rk3399-pinebook-pro.dts      |   1 +
 arch/arm64/include/asm/module.h                    |   1 +
 arch/arm64/include/asm/module.lds.h                |   1 +
 arch/arm64/kernel/ftrace.c                         |  13 +-
 arch/arm64/kernel/module-plts.c                    |  12 +-
 arch/arm64/kernel/module.c                         |  11 +
 arch/loongarch/kernel/signal.c                     |  10 +-
 arch/riscv/include/asm/asm.h                       |   2 +-
 arch/x86/include/asm/pgtable_64_types.h            |   3 +
 arch/x86/mm/init_64.c                              |  18 +
 drivers/acpi/arm64/iort.c                          |   4 +-
 drivers/bluetooth/hci_vhci.c                       |  57 +-
 drivers/cpufreq/intel_pstate.c                     | 126 ++---
 drivers/dma/mediatek/mtk-cqdma.c                   |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            | 146 ++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   6 +-
 drivers/gpu/drm/amd/amdgpu/dce_v10_0.c             |   5 -
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c             |   5 -
 drivers/gpu/drm/amd/amdgpu/dce_v6_0.c              |   5 -
 drivers/gpu/drm/amd/amdgpu/dce_v8_0.c              |   5 -
 .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c  |   8 +-
 drivers/gpu/drm/bridge/ti-sn65dsi86.c              |  11 +
 drivers/gpu/drm/mediatek/mtk_drm_drv.c             |  42 +-
 drivers/gpu/drm/mediatek/mtk_drm_drv.h             |   8 +-
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c    |   2 +
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c   |  23 +-
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c   |   1 +
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h    |   2 +
 drivers/hwmon/mlxreg-fan.c                         |   5 +-
 drivers/iio/chemical/pms7003.c                     |   5 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c         |   2 +-
 drivers/iio/light/opt3001.c                        |   5 +-
 drivers/iio/pressure/mprls0025pa.c                 |  10 +-
 drivers/isdn/mISDN/dsp_hwec.c                      |   6 +-
 drivers/net/ethernet/cadence/macb_main.c           |  28 +-
 drivers/net/ethernet/cavium/thunder/thunder_bgx.c  |  20 +-
 drivers/net/ethernet/intel/e1000e/ethtool.c        |  10 +-
 drivers/net/ethernet/intel/i40e/i40e_client.c      |   4 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |  10 +-
 drivers/net/ethernet/xircom/xirc2ps_cs.c           |   2 +-
 drivers/net/macsec.c                               |   8 +-
 drivers/net/pcs/pcs-rzn1-miic.c                    |   2 +-
 drivers/net/phy/mscc/mscc_ptp.c                    |  18 +-
 drivers/net/ppp/ppp_generic.c                      |   6 +-
 drivers/net/usb/cdc_ncm.c                          |   7 +
 drivers/net/vmxnet3/vmxnet3_drv.c                  |   5 +-
 drivers/net/wireless/ath/ath11k/core.h             |   7 +
 drivers/net/wireless/ath/ath11k/debugfs.c          |   4 +-
 drivers/net/wireless/ath/ath11k/debugfs_sta.c      |  30 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   8 +-
 drivers/net/wireless/ath/ath11k/dp_tx.c            |   4 +-
 drivers/net/wireless/ath/ath11k/mac.c              | 588 ++++++++++++---------
 drivers/net/wireless/ath/ath11k/peer.c             |   2 +-
 drivers/net/wireless/ath/ath11k/wmi.c              |   6 +-
 .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |   6 +-
 drivers/net/wireless/marvell/libertas/cfg.c        |   9 +-
 drivers/net/wireless/marvell/mwifiex/cfg80211.c    |   5 +-
 drivers/net/wireless/marvell/mwifiex/main.c        |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |   4 +-
 drivers/net/wireless/st/cw1200/sta.c               |   2 +-
 drivers/pci/msi/msi.c                              |   3 +
 drivers/pcmcia/omap_cf.c                           |   2 +
 drivers/pcmcia/rsrc_iodyn.c                        |   3 +
 drivers/pcmcia/rsrc_nonstatic.c                    |   4 +-
 drivers/platform/x86/amd/pmc/pmc-quirks.c          |  14 +
 drivers/scsi/lpfc/lpfc_nvmet.c                     |  10 +-
 drivers/soc/qcom/mdt_loader.c                      |  12 +-
 drivers/spi/spi-cadence-quadspi.c                  |   6 +-
 drivers/spi/spi-fsl-lpspi.c                        |  24 +-
 drivers/spi/spi-fsl-qspi.c                         |  36 +-
 drivers/tee/optee/ffa_abi.c                        |   4 +-
 drivers/tee/tee_shm.c                              |   6 +-
 drivers/thermal/mediatek/lvts_thermal.c            |  50 +-
 fs/btrfs/btrfs_inode.h                             |   2 +-
 fs/btrfs/extent_io.c                               |   2 +-
 fs/btrfs/inode.c                                   |   1 +
 fs/btrfs/tree-log.c                                |  78 ++-
 fs/fs-writeback.c                                  |   9 +-
 fs/ocfs2/inode.c                                   |   3 +
 fs/proc/generic.c                                  |  38 +-
 fs/smb/client/cifs_unicode.c                       |   3 +
 include/linux/bpf-cgroup.h                         |   5 -
 include/linux/bpf.h                                |  60 ++-
 include/linux/pci.h                                |   2 +
 include/linux/pgtable.h                            |  16 +
 include/linux/vmalloc.h                            |  16 -
 include/net/netlink.h                              |  69 ++-
 include/uapi/linux/netlink.h                       |   5 +
 kernel/bpf/core.c                                  |  50 +-
 kernel/bpf/syscall.c                               |  20 +-
 kernel/sched/topology.c                            |   2 +
 lib/nlattr.c                                       |  22 +
 mm/slub.c                                          |  66 ++-
 net/atm/resources.c                                |   6 +-
 net/ax25/ax25_in.c                                 |   4 +
 net/batman-adv/network-coding.c                    |   7 +-
 net/bluetooth/hci_sync.c                           |   2 +-
 net/bluetooth/l2cap_sock.c                         |   3 +
 net/bridge/br_netfilter_hooks.c                    |   3 -
 net/dsa/tag_ksz.c                                  |  22 +-
 net/ipv4/devinet.c                                 |   7 +-
 net/ipv4/icmp.c                                    |   6 +-
 net/ipv6/ip6_icmp.c                                |   6 +-
 net/mctp/af_mctp.c                                 |   2 +-
 net/netfilter/nf_conntrack_helper.c                |   4 +-
 net/netlink/policy.c                               |  14 +-
 net/smc/smc_clc.c                                  |   2 -
 net/smc/smc_ib.c                                   |   3 +
 net/wireless/scan.c                                |   3 +-
 net/wireless/sme.c                                 |   5 +-
 sound/pci/hda/patch_hdmi.c                         |   1 +
 sound/pci/hda/patch_realtek.c                      |   5 +
 sound/usb/mixer_quirks.c                           |   2 +
 tools/gpio/Makefile                                |   4 +-
 tools/perf/util/bpf-event.c                        |  39 +-
 tools/power/cpupower/utils/cpupower-set.c          |   4 +-
 tools/testing/selftests/net/bind_bhash.c           |   4 +-
 121 files changed, 1357 insertions(+), 838 deletions(-)