6.12.90-rc2 review

This is the start of the stable review cycle for the 6.12.90 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 18 May 2026 10:21:56 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc2.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.90-rc2

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Avoid overflow on msg bound check

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn3: Avoid overflow on msg bound check

Dudu Lu <[email protected]>
vsock/virtio: fix accept queue count leak on transport mismatch

Eric Dumazet <[email protected]>
vsock/virtio: fix potential unbounded skb queue

Stefano Garzarella <[email protected]>
vsock/virtio: fix empty payload in tap skb for non-linear buffers

Stefano Garzarella <[email protected]>
vsock/virtio: fix length and offset in tap skb for split packets

Norbert Szetei <[email protected]>
vsock: fix buffer size clamping order

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix tp_num leak on kmalloc failure

Jiexun Wang <[email protected]>
batman-adv: stop tp_meter sessions during mesh teardown

Steven Rostedt <[email protected]>
tracing/probes: Limit size of event probe to 3K

Yochai Eisenrich <[email protected]>
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak

Guangshuo Li <[email protected]>
btrfs: fix double free in create_space_info_sub_group() error path

Filipe Manana <[email protected]>
btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

Martin Michaelis <[email protected]>
io_uring/kbuf: support min length left for incremental buffers

Nikolay Aleksandrov <[email protected]>
bonding: fix use-after-free due to enslave fail after slave array update

Miguel Ojeda <[email protected]>
rust: allow clippy::collapsible_if globally

Miguel Ojeda <[email protected]>
rust: allow clippy::collapsible_match globally

SeongJae Park <[email protected]>
mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values

SeongJae Park <[email protected]>
mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values

SeongJae Park <[email protected]>
mm/damon/core: implement damon_kdamond_pid()

SeongJae Park <[email protected]>
mm/damon/core: disallow time-quota setting zero esz

Gary Guo <[email protected]>
rust: pin-init: fix incorrect accessor reference lifetime

Thomas Zimmermann <[email protected]>
fbcon: Avoid OOB font access if console rotation fails

David Carlier <[email protected]>
tracefs: Fix default permissions not being applied on initial mount

Damien Le Moal <[email protected]>
block: fix zone write plug removal

Damien Le Moal <[email protected]>
block: reorganize struct blk_zone_wplug

Damien Le Moal <[email protected]>
block: cleanup blkdev_report_zones()

Sang-Heon Jeon <[email protected]>
mm/hugetlb_cma: round up per_node before logging it

Johan Hovold <[email protected]>
spi: uniphier: fix controller deregistration

Pei Xiao <[email protected]>
spi: uniphier: Simplify clock handling with devm_clk_get_enabled()

Johan Hovold <[email protected]>
spi: tegra114: fix controller deregistration

Johan Hovold <[email protected]>
spi: tegra20-sflash: fix controller deregistration

Johan Hovold <[email protected]>
spi: zynq-qspi: fix controller deregistration

Pei Xiao <[email protected]>
spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()

David Carlier <[email protected]>
Bluetooth: hci_conn: fix potential UAF in create_big_sync

Cássio Gabriel <[email protected]>
ALSA: seq: Fix UMP group 16 filtering

Takashi Iwai <[email protected]>
ALSA: seq: Notify client and port info changes

Cássio Gabriel <[email protected]>
ALSA: core: Serialize deferred fasync state checks

Takashi Iwai <[email protected]>
ALSA: misc: Use guard() for spin locks

Cássio Gabriel <[email protected]>
ALSA: hda: cs35l56: Propagate ASP TX source control errors

Selvarasu Ganesan <[email protected]>
usb: dwc3: Move GUID programming after PHY initialization

Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: reset internal port states on soft reset AMS

Sven Eckelmann <[email protected]>
batman-adv: bla: put backbone reference on failed claim hash insert

Sven Eckelmann <[email protected]>
batman-adv: bla: only purge non-released claims

Sven Eckelmann <[email protected]>
batman-adv: bla: prevent use-after-free when deleting claims

Jiexun Wang <[email protected]>
batman-adv: stop caching unowned originator pointers in BAT IV

Jiexun Wang <[email protected]>
batman-adv: reject new tp_meter sessions during teardown

Lyes Bourennani <[email protected]>
batman-adv: fix integer overflow on buff_pos

Ben Morris <[email protected]>
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

Siddharth Vadapalli <[email protected]>
arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22

Alex Deucher <[email protected]>
drm/amdgpu/pm: align Hawaii mclk workaround with radeon

Alex Deucher <[email protected]>
drm/amdgpu/pm: add missing revision check for CI

John B. Moore <[email protected]>
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

Felix Kuehling <[email protected]>
drm/amdkfd: Make all TLB-flushes heavy-weight

Icenowy Zheng <[email protected]>
drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds

John B. Moore <[email protected]>
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ

Icenowy Zheng <[email protected]>
drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds

Osama Abdelkader <[email protected]>
drm/exynos: remove bridge when component_add fails

Philip Yang <[email protected]>
drm/amdgpu: zero-initialize GART table on allocation

Alex Deucher <[email protected]>
drm/radeon: add missing revision check for CI

Shuicheng Lin <[email protected]>
drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()

Shuicheng Lin <[email protected]>
drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

Shuicheng Lin <[email protected]>
drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()

Alysa Liu <[email protected]>
drm/amdkfd: validate SVM ioctl nattr against buffer size

Ashutosh Desai <[email protected]>
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

Mario Kleiner <[email protected]>
drm/amd/display: Change dither policy for 10 bpc output back to dithering

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

Benjamin Cheng <[email protected]>
drm/amdgpu/vce: Prevent partial address patches

Benjamin Cheng <[email protected]>
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

Benjamin Cheng <[email protected]>
drm/amdgpu: Add bounds checking to ib_{get,set}_value

Alysa Liu <[email protected]>
drm/amdkfd: Add upper bound check for num_of_nodes

Yang Wang <[email protected]>
drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x

Chenglei Xie <[email protected]>
drm/amdgpu: gate VM CPU HDP flush on reset lock

Ramalingeswara Reddy, Kanala <[email protected]>
drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.

Amir Shetaia <[email protected]>
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure

Jouni Högander <[email protected]>
drm/i915/psr: Init variable to avoid early exit from et alignment loop

Yasuaki Torimaru <[email protected]>
drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()

Johan Hovold <[email protected]>
spi: cadence: fix unclocked access on unbind

Johan Hovold <[email protected]>
spi: cadence: fix controller deregistration

Johan Hovold <[email protected]>
spi: mpc52xx: fix use-after-free on unbind

Johan Hovold <[email protected]>
spi: mpc52xx: fix controller deregistration

Johan Hovold <[email protected]>
spi: mpc52xx: fix use-after-free on registration failure

Johan Hovold <[email protected]>
spi: orion: fix clock imbalance on registration failure

Johan Hovold <[email protected]>
spi: orion: fix runtime pm leak on unbind

Johan Hovold <[email protected]>
spi: orion: fix controller deregistration

Johan Hovold <[email protected]>
spi: mxic: fix controller deregistration

Johan Hovold <[email protected]>
spi: imx: fix runtime pm leak on probe deferral

Johan Hovold <[email protected]>
spi: img-spfi: fix controller deregistration

Johan Hovold <[email protected]>
spi: rspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: sprd: fix controller deregistration

Johan Hovold <[email protected]>
spi: pic32-sqi: fix controller deregistration

Johan Hovold <[email protected]>
spi: npcm-pspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: coldfire-qspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: bcmbca-hsspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: fsl: fix controller deregistration

Johan Hovold <[email protected]>
spi: sh-hspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: pl022: fix controller deregistration

Johan Hovold <[email protected]>
spi: mtk-nor: fix controller deregistration

Johan Hovold <[email protected]>
spi: pic32: fix controller deregistration

Johan Hovold <[email protected]>
spi: omap2-mcspi: fix controller deregistration

Johan Hovold <[email protected]>
spi: fsl-espi: fix controller deregistration

Johan Hovold <[email protected]>
spi: s3c64xx: fix controller deregistration

Johan Hovold <[email protected]>
spi: dln2: fix controller deregistration

Johan Hovold <[email protected]>
spi: mxs: fix controller deregistration

Haoxiang Li <[email protected]>
media: omap3isp: drop the use count of v4l2 pipeline

Matthias Fend <[email protected]>
media: i2c: ov08d10: fix image vertical start setting

Michael Tretter <[email protected]>
media: staging: imx: request mbus_config in csi_start

Wenmeng Liu <[email protected]>
media: i2c: imx412: Assert reset GPIO during probe

Sergey Shtylyov <[email protected]>

    media: dib8000: avoid division by 0 in dib8000_set_dds()

Abdun Nihaal <[email protected]>
media: pci: zoran: fix potential memory leak in zoran_probe()

Luigi Leonardi <[email protected]>
vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy

Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Ignore backlight and FnLock events

Johan Hovold <[email protected]>
spi: aspeed-smc: fix controller deregistration

Wang Jun <[email protected]>
media: saa7164: add ioremap return checks and cleanups

Johan Hovold <[email protected]>
spi: at91-usart: fix controller deregistration

Johan Hovold <[email protected]>
spi: qup: fix controller deregistration

Johan Hovold <[email protected]>
spi: meson-spicc: fix controller deregistration

Johan Hovold <[email protected]>
spi: lantiq-ssc: fix controller deregistration

Johan Hovold <[email protected]>
regulator: bd9571mwv: fix OF node reference imbalance

Johan Hovold <[email protected]>
regulator: act8945a: fix OF node reference imbalance

Jai Luthra <[email protected]>
media: i2c: imx283: Fix hang when going from large to small resolution

Ethan Tidmore <[email protected]>
media: intel/ipu6: fix error pointer dereference

Janne Grunau <[email protected]>
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap

Johan Hovold <[email protected]>
regulator: rk808: fix OF node reference imbalance

Jai Luthra <[email protected]>
media: i2c: imx283: Enter full standby when stopping streaming

Oliver Neukum <[email protected]>
media: rc: streamzap: Error handling in probe

Oliver Neukum <[email protected]>
media: rc: xbox_remote: heed DMA restrictions

Johan Hovold <[email protected]>
regulator: max77650: fix OF node reference imbalance

Johan Hovold <[email protected]>
spi: st-ssc4: fix controller deregistration

Johan Hovold <[email protected]>
regulator: mt6357: fix OF node reference imbalance

Sakari Ailus <[email protected]>
staging: media: atomisp: Disallow all private IOCTLs

Josua Mayer <[email protected]>

    arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux

Johan Hovold <[email protected]>
spi: atmel: fix controller deregistration

Johan Hovold <[email protected]>
spi: bcm63xx: fix controller deregistration

Ziyi Guo <[email protected]>
media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change()

Ziyi Guo <[email protected]>
media: chips-media: wave5: add missing spinlock protection for send_eos_event()

Haoxiang Li <[email protected]>
media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()

Alexander Koskovich <[email protected]>
media: i2c: ov8856: free control handler on error in ov8856_init_controls()

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0

Ricardo Ribalda <[email protected]>
media: uvcvideo: Enable VB2_DMABUF for metadata stream

T.J. Mercier <[email protected]>
HID: playstation: Clamp num_touch_reports

-------------

Diffstat:

 Makefile                                           |   6 +-
 .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi |   7 +
 .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi    |   2 +
 arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi     |  24 +++
 .../boot/dts/freescale/fsl-lx2162a-clearfog.dts    |   2 +
 .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi     |   7 +
 arch/arm64/boot/dts/ti/k3-am62a7-sk.dts            |   2 +-
 block/blk-zoned.c                                  | 170 +++++++++------------
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c           |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h           |  11 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c         |  12 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |  31 +++-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   3 -
 drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |  25 ++-
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |  46 ++++--
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  33 +++-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |   6 +-
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h              |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_topology.c          |  11 ++
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |   2 +-
 .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c    |  13 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c   |  10 +-
 drivers/gpu/drm/drm_gem_framebuffer_helper.c       |   4 +-
 drivers/gpu/drm/exynos/exynos_drm_mic.c            |   8 +-
 drivers/gpu/drm/i915/display/intel_psr.c           |   2 +-
 drivers/gpu/drm/msm/msm_drv.c                      |   7 +-
 drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c     |   2 +
 drivers/gpu/drm/panel/panel-himax-hx83102.c        |   2 +
 drivers/gpu/drm/radeon/ci_dpm.c                    |   9 +-
 drivers/gpu/drm/xe/xe_bo.c                         |   8 +-
 drivers/gpu/drm/xe/xe_dma_buf.c                    |  11 +-
 drivers/hid/hid-playstation.c                      |   6 +-
 drivers/media/common/videobuf2/videobuf2-dma-sg.c  |   1 +
 drivers/media/dvb-frontends/dib8000.c              |   4 +-
 drivers/media/i2c/imx283.c                         |  15 +-
 drivers/media/i2c/imx412.c                         |   2 +-
 drivers/media/i2c/ov08d10.c                        |  10 +-
 drivers/media/i2c/ov8856.c                         |  10 +-
 drivers/media/pci/intel/ipu6/ipu6.c                |   2 +-
 drivers/media/pci/saa7164/saa7164-core.c           |  47 ++++--
 drivers/media/pci/zoran/zoran_card.c               |   2 +-
 .../media/platform/chips-media/wave5/wave5-vdi.c   |   1 +
 .../platform/chips-media/wave5/wave5-vpu-dec.c     |  14 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-video.c   |   2 +-
 drivers/media/platform/ti/omap3isp/ispvideo.c      |   1 +
 drivers/media/rc/streamzap.c                       |  12 +-
 drivers/media/rc/xbox_remote.c                     |   9 +-
 drivers/media/usb/uvc/uvc_queue.c                  |   3 +-
 drivers/net/bonding/bond_main.c                    |   6 +-
 drivers/platform/x86/hp/hp-wmi.c                   |   5 +
 drivers/regulator/act8945a-regulator.c             |   3 +-
 drivers/regulator/bd9571mwv-regulator.c            |   3 +-
 drivers/regulator/max77650-regulator.c             |   2 +-
 drivers/regulator/mt6357-regulator.c               |   2 +-
 drivers/regulator/rk808-regulator.c                |   3 +-
 drivers/spi/spi-aspeed-smc.c                       |   9 +-
 drivers/spi/spi-at91-usart.c                       |   8 +-
 drivers/spi/spi-atmel.c                            |   8 +-
 drivers/spi/spi-bcm63xx.c                          |   8 +-
 drivers/spi/spi-bcmbca-hsspi.c                     |   4 +-
 drivers/spi/spi-cadence.c                          |  15 +-
 drivers/spi/spi-coldfire-qspi.c                    |  10 +-
 drivers/spi/spi-dln2.c                             |   8 +-
 drivers/spi/spi-fsl-espi.c                         |  10 +-
 drivers/spi/spi-fsl-spi.c                          |  14 +-
 drivers/spi/spi-img-spfi.c                         |   8 +-
 drivers/spi/spi-imx.c                              |   1 +
 drivers/spi/spi-lantiq-ssc.c                       |   8 +-
 drivers/spi/spi-meson-spicc.c                      |   8 +-
 drivers/spi/spi-mpc52xx.c                          |   9 +-
 drivers/spi/spi-mtk-nor.c                          |   4 +-
 drivers/spi/spi-mxic.c                             |   3 +-
 drivers/spi/spi-mxs.c                              |   8 +-
 drivers/spi/spi-npcm-pspi.c                        |   8 +-
 drivers/spi/spi-omap2-mcspi.c                      |   8 +-
 drivers/spi/spi-orion.c                            |  16 +-
 drivers/spi/spi-pic32-sqi.c                        |   8 +-
 drivers/spi/spi-pic32.c                            |  11 +-
 drivers/spi/spi-pl022.c                            |   8 +-
 drivers/spi/spi-qup.c                              |   8 +-
 drivers/spi/spi-rspi.c                             |  10 +-
 drivers/spi/spi-s3c64xx.c                          |   4 +-
 drivers/spi/spi-sh-hspi.c                          |  10 +-
 drivers/spi/spi-sprd.c                             |   8 +-
 drivers/spi/spi-st-ssc4.c                          |   8 +-
 drivers/spi/spi-tegra114.c                         |   8 +-
 drivers/spi/spi-tegra20-sflash.c                   |   8 +-
 drivers/spi/spi-uniphier.c                         |  24 ++-
 drivers/spi/spi-zynq-qspi.c                        |  55 ++-----
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c  |   4 +
 drivers/staging/media/imx/imx-media-csi.c          |  40 +++--
 drivers/usb/dwc3/core.c                            |  12 +-
 drivers/usb/typec/tcpm/tcpm.c                      |   2 +
 drivers/video/fbdev/core/fbcon_rotate.c            |   5 +-
 fs/btrfs/ioctl.c                                   |   5 +-
 fs/btrfs/space-info.c                              |   8 +-
 fs/btrfs/sysfs.c                                   |   5 +-
 fs/btrfs/sysfs.h                                   |   3 +-
 fs/tracefs/inode.c                                 |   1 +
 include/linux/damon.h                              |   2 +
 include/uapi/linux/io_uring.h                      |   3 +-
 io_uring/kbuf.c                                    |   8 +-
 io_uring/kbuf.h                                    |   7 +
 kernel/trace/trace_probe.c                         |   6 +
 kernel/trace/trace_probe.h                         |   4 +-
 mm/damon/core.c                                    |  34 +++++
 mm/damon/lru_sort.c                                |  88 +++++++----
 mm/damon/reclaim.c                                 |  88 +++++++----
 mm/hugetlb.c                                       |   1 +
 net/batman-adv/bat_iv_ogm.c                        |  85 ++++++++---
 net/batman-adv/bridge_loop_avoidance.c             |  11 +-
 net/batman-adv/main.c                              |   1 +
 net/batman-adv/tp_meter.c                          | 116 +++++++++++---
 net/batman-adv/tp_meter.h                          |   1 +
 net/batman-adv/types.h                             |   4 +
 net/bluetooth/hci_conn.c                           |  19 ++-
 net/bluetooth/l2cap_sock.c                         |   3 +
 net/sctp/socket.c                                  |   9 ++
 net/vmw_vsock/af_vsock.c                           |   6 +-
 net/vmw_vsock/virtio_transport_common.c            |  57 +++----
 rust/kernel/init/__internal.rs                     |  28 ++--
 rust/kernel/init/macros.rs                         |  91 ++++++-----
 sound/core/misc.c                                  |  33 ++--
 sound/core/seq/seq_clientmgr.c                     |   9 +-
 sound/core/seq/seq_clientmgr.h                     |   5 +-
 sound/core/seq/seq_ump_client.c                    |   4 +-
 sound/pci/hda/cs35l56_hda.c                        |  19 ++-
 131 files changed, 1264 insertions(+), 586 deletions(-)