6.6.142-rc1 review

Greg Kroah-Hartman intel-wired-lan linux-fsdevel linux-patches lkml netfs stable 1 version May 28 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest May 28186 patches 11 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/186	mptcp: sync the msk->sndbuf at accept() time`net/mptcp/protocol.c`	+2 -1	0 replies
2/186	mptcp: pm: ADD_ADDR rtx: allow ID 0`net/mptcp/pm_netlink.c`	+0 -3	0 replies
3/186	mptcp: pm: ADD_ADDR rtx: always decrease sk refcount`net/mptcp/pm_netlink.c`	+3 -5	0 replies
4/186	mptcp: pm: ADD_ADDR rtx: free sk if last`net/mptcp/pm_netlink.c`	+17 ~~-11~~	0 replies
5/186	spi: spidev: fix lock inversion between spi_lock and buf_lock`drivers/spi/spidev.c`	+22 ~~-41~~	0 replies
6/186	driver core: generalize driver_override in struct device`drivers/base/bus.c` `drivers/base/core.c` `drivers/base/dd.c` +2 more	+162 -1	0 replies
7/186	driver core: platform: use generic driver_override infrastructure`drivers/base/platform.c` `drivers/bus/simple-pm-bus.c` `drivers/clk/imx/clk-scu.c` +3 more	+13 ~~-48~~	0 replies
8/186	s390/debug: Reject zero-length input before trimming a newline`arch/s390/kernel/debug.c`	+3 -0	0 replies
9/186	wifi: mac80211: check tdls flag in ieee80211_tdls_oper`net/mac80211/tdls.c`	+1 -1	0 replies
10/186	Revert "x86/vdso: Fix output operand size of RDPID"`arch/x86/include/asm/segment.h`	+4 -4	0 replies
11/186	ksmbd: avoid reclaiming expired durable opens by the client`fs/smb/server/vfs_cache.c` `fs/smb/server/vfs_cache.h`	+9 -1	0 replies
12/186	ksmbd: add durable scavenger timer`fs/smb/server/mgmt/user_session.c` `fs/smb/server/server.c` `fs/smb/server/server.h` +4 more	+167 -6	0 replies
13/186	ksmbd: validate owner of durable handle on reconnect`fs/smb/server/mgmt/user_session.c` `fs/smb/server/oplock.c` `fs/smb/server/oplock.h` +3 more	+103 ~~-15~~	0 replies
14/186	ksmbd: close durable scavenger races against m_fp_list lookups`fs/smb/server/vfs_cache.c`	+77 ~~-27~~	0 replies
15/186	af_unix: Give up GC if MSG_PEEK intervened.`include/net/af_unix.h` `net/unix/af_unix.c` `net/unix/garbage.c`	+54 ~~-28~~	0 replies
16/186	smb: client: reject userspace cifs.spnego descriptions`fs/smb/client/cifs_spnego.c`	+16 -0	0 replies
17/186	Revert "ice: fix double-free of tx_buf skb"`drivers/net/ethernet/intel/ice/ice_txrx.c`	+2 -4	0 replies
18/186	Revert "ice: Remove jumbo_remove step from TX path"`drivers/net/ethernet/intel/ice/ice_txrx.c`	+3 -0	0 replies
19/186	Revert "s390/cio: Update purge function to unregister the unused subchannels"`drivers/s390/cio/device.c`	+13 ~~-24~~	0 replies
20/186	Revert "af_unix: Reject SIOCATMARK on non-stream sockets"`net/unix/af_unix.c`	+0 -3	0 replies
21/186	i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue`drivers/i3c/master/mipi-i3c-hci/dma.c`	+17 ~~-10~~	0 replies
22/186	sysfs: dont remove existing directory on update failure`fs/sysfs/group.c`	+1 -1	0 replies
23/186	mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()`mm/damon/sysfs-schemes.c`	+1 -0	0 replies
24/186	ksmbd: fix null pointer dereference in compare_guid_key()`fs/smb/server/oplock.c`	+5 -1	0 replies
25/186	ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow`fs/smb/server/smbacl.c`	+9 -3	0 replies
26/186	smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()`fs/smb/client/smb2transport.c`	+2 -0	0 replies
27/186	smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close`fs/smb/server/vfs_cache.c`	+12 -4	0 replies
28/186	hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX`drivers/hwmon/pmbus/adm1266.c`	+1 -1	0 replies
29/186	ALSA: ua101: Reject too-short USB descriptors`sound/usb/misc/ua101.c`	+3 -2	0 replies
30/186	ALSA: pcm: Dont setup bogus iov_iter for silencing`sound/core/pcm_lib.c`	+3 -0	0 replies
31/186	ALSA: asihpi: Fix potential OOB array access at reading cache`sound/pci/asihpi/hpicmn.c`	+6 -0	0 replies
32/186	efi: Allocate runtime workqueue before ACPI init`drivers/firmware/efi/efi.c`	+16 ~~-12~~	0 replies
33/186	drivers/base/memory: fix memory block reference leak in poison accounting`drivers/base/memory.c`	+6 -2	0 replies
34/186	net: wwan: iosm: fix potential memory leaks in ipc_imem_init()`drivers/net/wwan/iosm/iosm_ipc_imem.c`	+2 -0	0 replies
35/186	Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()`net/bluetooth/af_bluetooth.c` `net/bluetooth/iso.c` `net/bluetooth/l2cap_sock.c` +2 more	+78 ~~-10~~	0 replies
36/186	Bluetooth: ISO: drop ISO_END frames received without prior ISO_START`net/bluetooth/iso.c`	+5 -0	0 replies
37/186	Bluetooth: bnep: Fix UAF read of dev->name`net/bluetooth/bnep/core.c`	+1 -1	0 replies
38/186	Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths`drivers/bluetooth/hci_ldisc.c`	+40 -8	0 replies
39/186	Bluetooth: MGMT: validate Add Extended Advertising Data length`net/bluetooth/mgmt.c`	+6 -0	0 replies
40/186	Bluetooth: serialize accept_q access`include/net/bluetooth/bluetooth.h` `net/bluetooth/af_bluetooth.c`	+66 ~~-22~~	0 replies
41/186	phonet/pep: disable BH around forwarded sk_receive_skb()`net/phonet/pep.c`	+17 -2	0 replies
42/186	net: bcmgenet: keep RBUF EEE/PM disabled`drivers/net/ethernet/broadcom/genet/bcmgenet.c`	+4 -5	0 replies
43/186	net: ifb: report ethtool stats over num_tx_queues`drivers/net/ifb.c`	+5 -6	0 replies
44/186	netfilter: ip6t_hbh: reject oversized option lists`net/ipv6/netfilter/ip6t_hbh.c`	+4 -0	0 replies
45/186	netfilter: nf_queue: hold bridge skb->dev while queued`include/net/netfilter/nf_queue.h` `net/netfilter/nf_queue.c` `net/netfilter/nfnetlink_queue.c`	+6 -1	0 replies
46/186	netfilter: ipset: stop hash:* range iteration at end`net/netfilter/ipset/ip_set_hash_ipmark.c` `net/netfilter/ipset/ip_set_hash_ipport.c` `net/netfilter/ipset/ip_set_hash_ipportip.c` +1 more	+17 -4	0 replies
47/186	netfilter: nft_inner: Fix IPv6 inner_thoff desync`net/netfilter/nft_inner.c`	+0 -1	0 replies
48/186	qed: fix double free in qed_cxt_tables_alloc()`drivers/net/ethernet/qlogic/qed/qed_cxt.c`	+2 -0	0 replies
49/186	ring-buffer: Fix reporting of missed events in iterator`kernel/trace/ring_buffer.c`	+3 -5	0 replies
50/186	vsock/vmci: fix UAF when peer resets connection during handshake`net/vmw_vsock/vmci_transport.c`	+1 -1	0 replies
51/186	vsock/virtio: reset connection on receiving queue overflow`net/vmw_vsock/virtio_transport_common.c`	+15 -5	0 replies
52/186	wifi: ath11k: clear shared SRNG pointer state on restart`drivers/net/wireless/ath/ath11k/hal.c`	+11 -3	0 replies
53/186	ipv4: raw: reject IP_HDRINCL packets with ihl < 5`net/ipv4/raw.c`	+1 -1	0 replies
54/186	ixgbevf: fix use-after-free in VEPA multicast source pruning`drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c`	+1 -0	0 replies
55/186	ice: fix setting promisc mode while adding VID filter`drivers/net/ethernet/intel/ice/ice_main.c`	+1 -1	0 replies
56/186	wifi: cfg80211: advance loop vars in cfg80211_merge_profile()`net/wireless/scan.c`	+3 -0	0 replies
57/186	cifs: Fix busy dentry used after unmounting`fs/smb/client/cifsfs.c`	+2 -0	0 replies
58/186	tracing: Do not call map->ops->elt_free() if elt_alloc() fails`kernel/trace/tracing_map.c`	+13 -4	0 replies
59/186	arm64: probes: Handle probes on hinted conditional branch instructions`arch/arm64/include/asm/insn.h`	+1 -1	0 replies
60/186	KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits`arch/arm64/kvm/vgic/vgic-its.c`	+4 -0	0 replies
61/186	drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe`drivers/gpu/drm/bridge/chipone-icn6211.c`	+3 -1	0 replies
62/186	spi: qup: fix error pointer deref after DMA setup failure`drivers/spi/spi-qup.c`	+3 -0	0 replies
63/186	phy: tegra: xusb: Fix per-pad high-speed termination calibration`drivers/phy/tegra/xusb-tegra186.c` `drivers/phy/tegra/xusb.h`	+27 -7	0 replies
64/186	scsi: isci: Fix use-after-free in device removal path`drivers/scsi/isci/host.c`	+3 -0	0 replies
65/186	spi: sprd: fix error pointer deref after DMA setup failure`drivers/spi/spi-sprd.c`	+2 -1	0 replies
66/186	spi: ti-qspi: fix use-after-free after DMA setup failure`drivers/spi/spi-ti-qspi.c`	+1 -0	0 replies
67/186	RDMA/siw: Reject MPA FPDU length underflow before signed receive math`drivers/infiniband/sw/siw/siw_qp_rx.c`	+15 -0	0 replies
68/186	LoongArch: Remove unused code to avoid build warning`arch/loongarch/mm/init.c`	+0 -4	0 replies
69/186	device property: set fwnode->secondary to NULL in fwnode_init()`include/linux/fwnode.h`	+1 -0	0 replies
70/186	drm/virtio: use uninterruptible resv lock for plane updates`drivers/gpu/drm/virtio/virtgpu_drv.h` `drivers/gpu/drm/virtio/virtgpu_gem.c` `drivers/gpu/drm/virtio/virtgpu_plane.c`	+26 -2	0 replies
71/186	drm/bridge: it66121: acquire reset GPIO in probe`drivers/gpu/drm/bridge/ite-it66121.c`	+5 -0	0 replies
72/186	drm/bridge: megachips: remove bridge when irq request fails`drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c`	+10 -6	0 replies
73/186	drm/amd/display: Fix integer overflow in bios_get_image()`drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.c`	+6 -3	0 replies
74/186	drm/amd/display: Validate GPIO pin LUT table size before iterating`drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c`	+9 -0	0 replies
75/186	drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async`drivers/gpu/drm/amd/display/dc/core/dc.c`	+5 -1	0 replies
76/186	batman-adv: mcast: fix use-after-free in orig_node RCU release`net/batman-adv/originator.c`	+2 -2	0 replies
77/186	batman-adv: clear current gateway during teardown`net/batman-adv/gateway_client.c`	+4 -0	0 replies
78/186	batman-adv: dat: handle forward allocation error`net/batman-adv/distributed-arp-table.c`	+3 -0	0 replies
79/186	batman-adv: fix fragment reassembly length accounting`net/batman-adv/fragmentation.c` `net/batman-adv/types.h`	+18 -7	0 replies
80/186	batman-adv: fix tp_meter counter underflow during shutdown`net/batman-adv/tp_meter.c`	+2 -2	0 replies
81/186	batman-adv: frag: disallow unicast fragment in fragment`net/batman-adv/fragmentation.c`	+35 -0	0 replies
82/186	batman-adv: bla: fix report_work leak on backbone_gw purge`net/batman-adv/bridge_loop_avoidance.c`	+38 ~~-22~~	0 replies
83/186	batman-adv: tp_meter: avoid use of uninit sender vars`net/batman-adv/tp_meter.c`	+9 -2	0 replies
84/186	batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown`net/batman-adv/tp_meter.c` `net/batman-adv/types.h`	+14 -2	0 replies
85/186	batman-adv: tp_meter: fix race condition in send error reporting`net/batman-adv/tp_meter.c` `net/batman-adv/types.h`	+30 ~~-20~~	0 replies
86/186	batman-adv: tt: fix negative last_changeset_len`net/batman-adv/types.h`	+1 -1	0 replies
87/186	batman-adv: tt: fix negative tt_buff_len`net/batman-adv/types.h`	+1 -1	0 replies
88/186	hwmon: (pmbus/adm1266) seed timestamp from the real-time clock`drivers/hwmon/pmbus/adm1266.c`	+1 -1	0 replies
89/186	hwmon: (pmbus/adm1266) reject implausible blackbox record_count`drivers/hwmon/pmbus/adm1266.c`	+3 -0	0 replies
90/186	hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer`drivers/hwmon/pmbus/adm1266.c`	+1 -1	0 replies
91/186	hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer`drivers/hwmon/pmbus/adm1266.c`	+3 -1	0 replies
92/186	hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR`drivers/hwmon/pmbus/adm1266.c`	+1 -1	0 replies
93/186	hwmon: (pmbus/adm1266) dont clobber GPIO bits before PDIO read in get_multiple`drivers/hwmon/pmbus/adm1266.c`	+0 -1	0 replies
94/186	hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()`drivers/hwmon/pmbus/adm1266.c`	+4 -4	0 replies
95/186	hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()`drivers/hwmon/pmbus/adm1266.c`	+4 -4	0 replies
96/186	hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors`drivers/hwmon/pmbus/adm1266.c`	+6 -0	0 replies
97/186	HID: uclogic: Fix regression of input name assignment`drivers/hid/hid-uclogic-core.c`	+3 -1	0 replies
98/186	firmware: arm_ffa: Check for NULL FF-A ID table while driver registration`drivers/firmware/arm_ffa/bus.c`	+3 -1	0 replies
99/186	firmware: arm_ffa: Skip free_pages on RX buffer alloc failure`drivers/firmware/arm_ffa/driver.c`	+1 -1	0 replies
100/186	kunit: config: Enable KUNIT_DEBUGFS by default`lib/kunit/Kconfig`	+2 -2	0 replies
101/186	kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS`lib/kunit/Kconfig`	+1 -0	0 replies
102/186	pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150`drivers/pinctrl/qcom/pinctrl-sm8150.c`	+4 -4	0 replies
103/186	ARM: integrator: Fix early initialization`arch/arm/mach-versatile/integrator_cp.c`	+4 -9	0 replies
104/186	ALSA: hda: cs35l56: Put ACPI device after setting companion`sound/pci/hda/cs35l56_hda.c`	+1 -0	0 replies
105/186	btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()`include/trace/events/btrfs.h`	+1 -3	0 replies
106/186	netfilter: x_tables: unregister the templates first`net/ipv4/netfilter/arptable_filter.c` `net/ipv4/netfilter/iptable_filter.c` `net/ipv4/netfilter/iptable_mangle.c` +6 more	+9 -9	0 replies
107/186	netfilter: arptables: allow xtables-nft only builds`net/ipv4/netfilter/Kconfig`	+13 ~~-15~~	0 replies
108/186	netfilter: xtables: allow xtables-nft only builds`net/ipv4/netfilter/Kconfig` `net/ipv4/netfilter/Makefile` `net/ipv6/netfilter/Kconfig` +2 more	+34 ~~-17~~	0 replies
109/186	netfilter: ebtables: allow xtables-nft only builds`net/bridge/netfilter/Kconfig` `net/bridge/netfilter/Makefile`	+8 -1	0 replies
110/186	netfilter: xtables: fix up kconfig dependencies`net/ipv4/netfilter/Kconfig`	+2 -1	0 replies
111/186	netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c`net/ipv4/netfilter/Kconfig`	+1 -0	0 replies
112/186	netfilter: Make legacy configs user selectable`net/bridge/netfilter/Kconfig` `net/ipv4/netfilter/Kconfig` `net/ipv6/netfilter/Kconfig`	+29 -4	0 replies
113/186	netfilter: Exclude LEGACY TABLES on PREEMPT_RT.`net/bridge/netfilter/Kconfig` `net/ipv4/netfilter/Kconfig` `net/ipv6/netfilter/Kconfig` +2 more	+47 ~~-32~~	2 replies
114/186	netfilter: x_tables: add and use xt_unregister_table_pre_exit`include/linux/netfilter/x_tables.h` `include/linux/netfilter_arp/arp_tables.h` `include/linux/netfilter_ipv4/ip_tables.h` +16 more	+41 ~~-39~~	0 replies
115/186	netfilter: x_tables: add and use xtables_unregister_table_exit`include/linux/netfilter/x_tables.h` `net/ipv4/netfilter/arp_tables.c` `net/ipv4/netfilter/ip_tables.c` +4 more	+83 ~~-37~~	0 replies
116/186	netfilter: ebtables: move to two-stage removal scheme`net/bridge/netfilter/ebtable_broute.c` `net/bridge/netfilter/ebtable_filter.c` `net/bridge/netfilter/ebtable_nat.c` +1 more	+40 ~~-26~~	0 replies
117/186	netfilter: ebtables: close dangling table module init race`net/bridge/netfilter/ebtable_broute.c` `net/bridge/netfilter/ebtable_filter.c` `net/bridge/netfilter/ebtable_nat.c`	+14 ~~-20~~	0 replies
118/186	netfilter: x_tables: close dangling table module init race`net/ipv4/netfilter/arptable_filter.c` `net/ipv4/netfilter/iptable_filter.c` `net/ipv4/netfilter/iptable_mangle.c` +6 more	+105 ~~-99~~	0 replies
119/186	netfilter: bridge: eb_tables: close module init race`net/bridge/netfilter/ebtables.c`	+6 -5	0 replies
120/186	kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()`include/asm-generic/kprobes.h`	+1 -1	0 replies
121/186	test_kprobes: clear kprobes between test runs`lib/test_kprobes.c`	+18 ~~-11~~	0 replies
122/186	tcp: Fix imbalanced icsk_accept_queue count.`net/ipv4/inet_connection_sock.c`	+1 -1	0 replies
123/186	ice: fix locking in ice_dcb_rebuild()`drivers/net/ethernet/intel/ice/ice_dcb_lib.c`	+2 -2	0 replies
124/186	net: lan966x: avoid unregistering netdev on register failure`drivers/net/ethernet/microchip/lan966x/lan966x_main.c`	+5 -3	0 replies
125/186	phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access`drivers/phy/marvell/phy-mvebu-a3700-utmi.c`	+2 -3	0 replies
126/186	irqchip/ath79-cpu: Remove unused function`drivers/irqchip/irq-ath79-cpu.c`	+0 -7	0 replies
127/186	irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT`kernel/irq_work.c`	+7 -0	0 replies
128/186	zonefs: handle integer overflow in zonefs_fname_to_fno`fs/zonefs/super.c`	+5 -1	0 replies
129/186	netfs: Fix overrun check in netfs_extract_user_iter()`fs/netfs/iterator.c`	+17 -9	0 replies
130/186	net: ethernet: cortina: Make RX SKB per-port`drivers/net/ethernet/cortina/gemini.c`	+6 -1	0 replies
131/186	net: ethernet: cortina: Drop half-assembled SKB`drivers/net/ethernet/cortina/gemini.c`	+5 -0	0 replies
132/186	net: ethernet: cortina: Carry over frag counter`drivers/net/ethernet/cortina/gemini.c`	+8 -1	0 replies
133/186	net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference`drivers/net/ethernet/cirrus/cs89x0.c`	+0 -2	0 replies
134/186	wifi: ath11k: fix error path leaks in some WMI WOW calls`drivers/net/wireless/ath/ath11k/wmi.c`	+16 -3	0 replies
135/186	wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()`drivers/net/wireless/ath/ath11k/testmode.c`	+1 -0	0 replies
136/186	HID: quirks: really enable the intended work around for appledisplay`drivers/hid/hid-quirks.c`	+1 -1	0 replies
137/186	accel/qaic: Add overflow check to remap_pfn_range during mmap`drivers/accel/qaic/qaic_data.c`	+21 -2	0 replies
138/186	net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint`net/smc/smc_tracepoint.h`	+1 -1	0 replies
139/186	ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics`net/ethtool/bitset.c`	+4 -4	0 replies
140/186	drm/msm/dsi: dont dump registers past the mapped region`drivers/gpu/drm/msm/dsi/dsi_host.c`	+1 -0	0 replies
141/186	drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN`drivers/gpu/drm/msm/msm_iommu.c`	+3 -2	0 replies
142/186	powerpc/time: Remove redundant preempt_disable\|enable() calls from arch_irq_work_raise()`arch/powerpc/kernel/time.c`	+4 -2	0 replies
143/186	net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot`net/smc/af_smc.c`	+2 -1	0 replies
144/186	net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring`net/tls/tls_sw.c`	+2 -4	0 replies
145/186	net: tls: prevent chain-after-chain in plain text SG`net/tls/tls_sw.c`	+18 -6	0 replies
146/186	net: phy: c45: add genphy_c45_pma_read_ext_abilities() function`drivers/net/phy/phy-c45.c` `include/linux/phy.h`	+75 ~~-55~~	0 replies
147/186	net: phy: DP83TC811: add reading of abilities`drivers/net/phy/dp83tc811.c`	+1 -0	0 replies
148/186	x86/xen: Fix xen_e820_swap_entry_with_ram()`arch/x86/xen/setup.c`	+1 -1	0 replies
149/186	tls: Preserve sk_err across recvmsg() when data has been copied`net/tls/tls_sw.c`	+14 -6	0 replies
150/186	net/mlx5: Do not restore destination-less TC rules`drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c`	+2 -1	0 replies
151/186	spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()`drivers/spi/spi-mtk-snfi.c`	+1 -1	0 replies
152/186	drm/msm/snapshot: fix dumping of the unaligned regions`drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c`	+18 -6	0 replies
153/186	wifi: ath11k: fix peer resolution on rx path when peer_id=0`drivers/net/wireless/ath/ath11k/dp_rx.c` `drivers/net/wireless/ath/ath11k/hal_rx.c`	+2 -6	0 replies
154/186	net: dsa: mt7530: fix FDB entries not aging out with short timeout`drivers/net/dsa/mt7530.c`	+14 -6	0 replies
155/186	net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw`drivers/net/dsa/mt7530.c` `drivers/net/dsa/mt7530.h`	+56 ~~-64~~	0 replies
156/186	net: dsa: mt7530: preserve VLAN tags on trapped link-local frames`drivers/net/dsa/mt7530.c`	+15 ~~-12~~	0 replies
157/186	net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer`drivers/net/ethernet/microsoft/mana/hw_channel.c`	+13 ~~-10~~	0 replies
158/186	platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL`drivers/platform/x86/adv_swbutton.c`	+5 -1	0 replies
159/186	platform/x86: hp_accel: Check ACPI_COMPANION() against NULL`drivers/platform/x86/hp/hp_accel.c`	+3 -0	0 replies
160/186	platform/x86: intel-hid: Check ACPI_HANDLE() against NULL`drivers/platform/x86/intel/hid.c`	+5 -1	0 replies
161/186	platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL`drivers/platform/x86/intel/vbtn.c`	+5 -1	0 replies
162/186	RDMA/rtrs: Fix use-after-free in path file creation cleanup`drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c`	+1 -1	0 replies
163/186	net: bridge: Flush multicast groups when snooping is disabled`net/bridge/br_multicast.c`	+9 -0	0 replies
164/186	bridge: mcast: Fix a possible use-after-free when removing a bridge port`net/bridge/br_multicast.c`	+17 -5	0 replies
165/186	pds_core: fix error handling in pdsc_devcmd_wait`drivers/net/ethernet/amd/pds_core/dev.c`	+9 -2	0 replies
166/186	pds_core: fix debugfs_lookup dentry leak and error handling`drivers/net/ethernet/amd/pds_core/debugfs.c`	+6 -1	0 replies
167/186	ptrace: Convert ptrace_attach() to use lock guards`include/linux/sched/task.h` `include/linux/spinlock.h` `kernel/ptrace.c`	+89 ~~-67~~	0 replies
168/186	ALSA: seq: ump: Use guard() for locking`sound/core/seq/seq_ump_client.c`	+5 -8	0 replies
169/186	ALSA: seq: Serialize UMP output teardown with event_input`sound/core/seq/seq_ump_client.c`	+18 -4	0 replies
170/186	tracing: Avoid NULL return from hist_field_name() on truncation`kernel/trace/trace_events_hist.c`	+2 -4	0 replies
171/186	Bluetooth: btmtk: add the function to get the fw name`drivers/bluetooth/btmtk.c` `drivers/bluetooth/btmtk.h`	+26 -0	0 replies
172/186	Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset`drivers/bluetooth/btusb.c`	+27 ~~-18~~	0 replies
173/186	Bluetooth: btmtk: rename btmediatek_data`drivers/bluetooth/btmtk.c` `drivers/bluetooth/btmtk.h` `drivers/bluetooth/btusb.c`	+10 ~~-11~~	0 replies
174/186	Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c`drivers/bluetooth/btmtk.c` `drivers/bluetooth/btmtk.h` `drivers/bluetooth/btmtksdio.c` +2 more	+305 ~~-283~~	0 replies
175/186	Bluetooth: btmtk: fix urb->setup_packet leak in error paths`drivers/bluetooth/btmtk.c`	+2 -0	0 replies
176/186	net: ag71xx: check error for platform_get_irq`drivers/net/ethernet/atheros/ag71xx.c`	+3 -0	0 replies
177/186	bpf, skmsg: fix verdict sk_data_ready racing with ktls rx`net/core/skmsg.c`	+7 -2	0 replies
178/186	string: add mem_is_zero() helper to check if memory area is all zeros`include/linux/string.h`	+12 -0	0 replies
179/186	gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)`drivers/gpio/gpiolib-cdev.c`	+4 -4	0 replies
180/186	gpio: cdev: check if uAPI v2 config attributes are correctly zeroed`drivers/gpio/gpiolib-cdev.c`	+13 -0	0 replies
181/186	ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()`sound/soc/codecs/cs35l56-sdw.c`	+2 -1	0 replies
182/186	net: mana: validate rx_req_idx to prevent out-of-bounds array access`drivers/net/ethernet/microsoft/mana/hw_channel.c`	+6 -0	0 replies
183/186	pds_core: add an error code check in pdsc_dl_info_get`drivers/net/ethernet/amd/pds_core/devlink.c`	+2 -0	0 replies
184/186	pds_core: ensure null-termination for firmware version strings`drivers/net/ethernet/amd/pds_core/devlink.c`	+4 -2	0 replies
185/186	net: gro: dont merge zcopy skbs`net/core/gro.c`	+3 -0	0 replies
186/186	LoongArch: kprobes: Fix handling of fatal unrecoverable recursions`arch/loongarch/kernel/kprobes.c`	+2 -2	0 replies

Reviews trailers per patch

87 of 186 patches have a Reviewed-by or Acked-by.

Patch	Paolo Abeni	Matthieu Baerts (NGI0)	Namjae Jeon	David Howells	Mat Martineau	Frank Li	Rafael J. Wysocki (Intel)	Danilo Krummrich	Gui-Dong Han	Greg Kroah-Hartman	Benjamin Block	Vasily Gorbik	[email protected]	Miaohe Lin	Oscar Salvador	David Hildenbrand (Arm)	Siwei Zhang	Jann Horn	Rémi Denis-Courmont	Eric Dumazet	Florian Fainelli	Fernando Fernandez Mancera	Masami Hiramatsu (Google)	Bryan Tan	Rameshkumar Sundaram	Baochen Qiang	Shyam Prasad N	Simon Horman	Rafal Romanowski	Rinitha S	Luca Ceresoli	Steve French	Jon Hunter	Alex Hung	Dan Wheeler	Linus Lüssing	Yuan Tan	Ren Wei	Simon Wunderlich	Bernard Metzler	Bartosz Golaszewski	Linus Walleij	Guo Ren	Konrad Dybcio	Simon Trimmer	Andy Shevchenko	Sakari Ailus	Javier Martinez Canillas	Ian Ray	Tristan Madani	Aleksandr Loktionov	Przemek Kitszel	Arpana Arland	Phil Sutter	Miquel Raynal	Sebastian Andrzej Siewior	Alexander Lobakin	Karol Wachowski	Jeff Hugo	Dust Li	Sidraya Jayagond	Shrikanth Hegde	Ritesh Harjani (IBM)	Randy Dunlap	Boris Burkov	David Sterba	Chester A. Unal	Ilpo Järvinen	Ido Schimmel	Nikolay Aleksandrov	Andrew Lunn	Russell King (Oracle)	Oleg Nesterov	Oleksij Rempel	Kees Cook	Kent Gibson	Haiyang Zhang	Shannon Nelson	Jan Beulich	Jianbo Liu	Cosmin Ratiu	P Praneesh	Sabrina Dubroca	Willem de Bruijn	Ron Economos	Miguel Ojeda	Francesco Dolcini	Brett A C Sheffield	Pavel Machek (CIP)	Peter Schneider	Wentao Guan	Mark Brown
Series																					T-b																																																																T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/186	A-b	R-b
2/186					R-b
3/186					R-b
4/186					R-b
5/186
6/186									T-b	R-b
7/186										R-b
8/186											R-b	R-b T-b
9/186													T-b
10/186
11/186
12/186
13/186
14/186			A-b
15/186
16/186				R-b
17/186
18/186
19/186
20/186
21/186						R-b
22/186							R-b	R-b
23/186
24/186			A-b
25/186			A-b
26/186																											R-b
27/186			A-b																													T-b
28/186
29/186
30/186
31/186
32/186							R-b
33/186														R-b	A-b	A-b
34/186
35/186																	R-b
36/186
37/186
38/186
39/186
40/186																		R-b
41/186																			A-b	R-b
42/186																					R-b
43/186
44/186
45/186
46/186
47/186																						R-b
48/186
49/186																							A-b
50/186																								A-b
51/186
52/186																									R-b	R-b
53/186
54/186																												R-b	T-b
55/186																												R-b		T-b
56/186
57/186																											R-b
58/186
59/186
60/186
61/186																															R-b
62/186
63/186																																	R-b T-b
64/186
65/186
66/186
67/186																																								A-b
68/186																																											R-b
69/186							R-b																																							R-b	R-b
70/186
71/186																																																R-b T-b
72/186																															R-b																		T-b
73/186																																		R-b	T-b
74/186																																		R-b	T-b
75/186																																		R-b	T-b
76/186																																				A-b
77/186
78/186																																					R-b
79/186																																						T-b
80/186
81/186																																					R-b
82/186																																							R-b
83/186																																					R-b
84/186
85/186
86/186
87/186
88/186
89/186
90/186
91/186
92/186																																									R-b	R-b
93/186																																									R-b	R-b
94/186																																									R-b
95/186
96/186																																									R-b
97/186
98/186
99/186
100/186
101/186
102/186																																												R-b
103/186
104/186																																													T-b
105/186																																																																	R-b	R-b
106/186																																																		R-b
107/186																																																						R-b
108/186
109/186
110/186																																																																A-b T-b
111/186																												R-b
112/186
113/186
114/186																																																		R-b
115/186																																																		R-b
116/186																																																		R-b
117/186																																																		R-b
118/186
119/186
120/186
121/186
122/186
123/186																																																			R-b	R-b	T-b
124/186
125/186																																																							R-b
126/186
127/186																																																								R-b
128/186
129/186
130/186
131/186																																																									R-b
132/186
133/186
134/186																									R-b	R-b
135/186																									R-b	R-b
136/186
137/186																																																										R-b	R-b
138/186																																																												R-b	R-b
139/186
140/186																																												R-b
141/186
142/186																																																														A-b	R-b
143/186
144/186																																																																																			R-b
145/186
146/186																																																																							R-b	R-b
147/186																																																																							R-b
148/186																																																																															R-b
149/186
150/186																																																																																R-b	R-b
151/186
152/186
153/186																										R-b																																																								R-b
154/186
155/186
156/186																																																																			A-b
157/186
158/186																																														R-b																						R-b
159/186																																														R-b																						R-b
160/186																																														R-b																						R-b
161/186																																														R-b																						R-b
162/186
163/186																																																																					R-b	A-b
164/186																																																																						A-b
165/186
166/186
167/186																																																																									R-b
168/186
169/186
170/186
171/186
172/186
173/186
174/186
175/186
176/186																																																																										R-b
177/186
178/186																																														R-b																													R-b
179/186
180/186																																																																												R-b
181/186
182/186																																																																													R-b
183/186																																																																														R-b
184/186
185/186																																																																																				R-b
186/186

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 92 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 000/186] 6.6.142-rc1 review

This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 30 May 2026 19:48:57 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.142-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.142-rc1

Tiezhu Yang <[email protected]>
LoongArch: kprobes: Fix handling of fatal unrecoverable recursions

Sabrina Dubroca <[email protected]>
net: gro: don't merge zcopy skbs

Nikhil P. Rao <[email protected]>
pds_core: ensure null-termination for firmware version strings

Su Hui <[email protected]>
pds_core: add an error code check in pdsc_dl_info_get

Aditya Garg <[email protected]>
net: mana: validate rx_req_idx to prevent out-of-bounds array access

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()

Bartosz Golaszewski <[email protected]>
gpio: cdev: check if uAPI v2 config attributes are correctly zeroed

Andy Shevchenko <[email protected]>
gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)

Jani Nikula <[email protected]>
string: add mem_is_zero() helper to check if memory area is all zeros

Xingwang Xiang <[email protected]>
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

Rosen Penev <[email protected]>
net: ag71xx: check error for platform_get_irq

Jiajia Liu <[email protected]>

    Bluetooth: btmtk: fix urb->setup_packet leak in error paths

Chris Lu <[email protected]>
Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c

Chris Lu <[email protected]>
Bluetooth: btmtk: rename btmediatek_data

Hao Qin <[email protected]>
Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset

Sean Wang <[email protected]>
Bluetooth: btmtk: add the function to get the fw name

David Carlier <[email protected]>
tracing: Avoid NULL return from hist_field_name() on truncation

Zhang Cen <[email protected]>
ALSA: seq: Serialize UMP output teardown with event_input

Takashi Iwai <[email protected]>
ALSA: seq: ump: Use guard() for locking

Peter Zijlstra <[email protected]>
ptrace: Convert ptrace_attach() to use lock guards

Nikhil P. Rao <[email protected]>
pds_core: fix debugfs_lookup dentry leak and error handling

Nikhil P. Rao <[email protected]>
pds_core: fix error handling in pdsc_devcmd_wait

Ido Schimmel <[email protected]>
bridge: mcast: Fix a possible use-after-free when removing a bridge port

Petr Machata <[email protected]>
net: bridge: Flush multicast groups when snooping is disabled

Guangshuo Li <[email protected]>
RDMA/rtrs: Fix use-after-free in path file creation cleanup

Rafael J. Wysocki <[email protected]>
platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: intel-hid: Check ACPI_HANDLE() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: hp_accel: Check ACPI_COMPANION() against NULL

Rafael J. Wysocki <[email protected]>
platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

Daniel Golle <[email protected]>
net: dsa: mt7530: preserve VLAN tags on trapped link-local frames

Arınç ÜNAL <[email protected]>

    net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw

Daniel Golle <[email protected]>
net: dsa: mt7530: fix FDB entries not aging out with short timeout

Matthew Leach <[email protected]>
wifi: ath11k: fix peer resolution on rx path when peer_id=0

Dmitry Baryshkov <[email protected]>
drm/msm/snapshot: fix dumping of the unaligned regions

Felix Gu <[email protected]>
spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()

Jeroen Massar <[email protected]>
net/mlx5: Do not restore destination-less TC rules

Chuck Lever <[email protected]>
tls: Preserve sk_err across recvmsg() when data has been copied

Juergen Gross <[email protected]>

    x86/xen: Fix xen_e820_swap_entry_with_ram()

Sven Schuchmann <[email protected]>
net: phy: DP83TC811: add reading of abilities

Oleksij Rempel <[email protected]>
net: phy: c45: add genphy_c45_pma_read_ext_abilities() function

Jakub Kicinski <[email protected]>
net: tls: prevent chain-after-chain in plain text SG

Jakub Kicinski <[email protected]>
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

Xiang Mei <[email protected]>
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

Sayali Patil <[email protected]>
powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

Mikko Perttunen <[email protected]>
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: don't dump registers past the mapped region

Chenguang Zhao <[email protected]>
ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics

Xiang Mei <[email protected]>

    net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

Zack McKevitt <[email protected]>
accel/qaic: Add overflow check to remap_pfn_range during mmap

Lukas Bulwahn <[email protected]>
HID: quirks: really enable the intended work around for appledisplay

Nicolas Escande <[email protected]>
wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()

Nicolas Escande <[email protected]>
wifi: ath11k: fix error path leaks in some WMI WOW calls

Ethan Nelson-Moore <[email protected]>
net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference

Linus Walleij <[email protected]>
net: ethernet: cortina: Carry over frag counter

Andreas Haarmann-Thiemann <[email protected]>
net: ethernet: cortina: Drop half-assembled SKB

Linus Walleij <[email protected]>
net: ethernet: cortina: Make RX SKB per-port

David Howells <[email protected]>
netfs: Fix overrun check in netfs_extract_user_iter()

Johannes Thumshirn <[email protected]>
zonefs: handle integer overflow in zonefs_fname_to_fno

Jiayuan Chen <[email protected]>
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

Rosen Penev <[email protected]>
irqchip/ath79-cpu: Remove unused function

Gabor Juhos <[email protected]>
phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access

Myeonghun Pak <[email protected]>
net: lan966x: avoid unregistering netdev on register failure

Bart Van Assche <[email protected]>
ice: fix locking in ice_dcb_rebuild()

Kuniyuki Iwashima <[email protected]>
tcp: Fix imbalanced icsk_accept_queue count.

Martin Kaiser <[email protected]>
test_kprobes: clear kprobes between test runs

Jianpeng Chang <[email protected]>
kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()

Florian Westphal <[email protected]>
netfilter: bridge: eb_tables: close module init race

Florian Westphal <[email protected]>
netfilter: x_tables: close dangling table module init race

Florian Westphal <[email protected]>
netfilter: ebtables: close dangling table module init race

Florian Westphal <[email protected]>
netfilter: ebtables: move to two-stage removal scheme

Florian Westphal <[email protected]>
netfilter: x_tables: add and use xtables_unregister_table_exit

Florian Westphal <[email protected]>
netfilter: x_tables: add and use xt_unregister_table_pre_exit

Pablo Neira Ayuso <[email protected]>
netfilter: Exclude LEGACY TABLES on PREEMPT_RT.

Breno Leitao <[email protected]>
netfilter: Make legacy configs user selectable

Kuniyuki Iwashima <[email protected]>
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c

Florian Westphal <[email protected]>
netfilter: xtables: fix up kconfig dependencies

Florian Westphal <[email protected]>
netfilter: ebtables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: xtables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: arptables: allow xtables-nft only builds

Florian Westphal <[email protected]>
netfilter: x_tables: unregister the templates first

Filipe Manana <[email protected]>
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

Shuhao Fu <[email protected]>
ALSA: hda: cs35l56: Put ACPI device after setting companion

Guenter Roeck <[email protected]>
ARM: integrator: Fix early initialization

Maulik Shah <[email protected]>
pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150

David Gow <[email protected]>
kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS

David Gow <[email protected]>
kunit: config: Enable KUNIT_DEBUGFS by default

Sudeep Holla <[email protected]>
firmware: arm_ffa: Skip free_pages on RX buffer alloc failure

Sudeep Holla <[email protected]>
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

Takashi Iwai <[email protected]>
HID: uclogic: Fix regression of input name assignment

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject implausible blackbox record_count

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) seed timestamp from the real-time clock

Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative tt_buff_len

Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative last_changeset_len

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix race condition in send error reporting

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid use of uninit sender vars

Sven Eckelmann <[email protected]>
batman-adv: bla: fix report_work leak on backbone_gw purge

Sven Eckelmann <[email protected]>
batman-adv: frag: disallow unicast fragment in fragment

Luxiao Xu <[email protected]>
batman-adv: fix tp_meter counter underflow during shutdown

Ruide Cao <[email protected]>
batman-adv: fix fragment reassembly length accounting

Sven Eckelmann <[email protected]>
batman-adv: dat: handle forward allocation error

Ruijie Li <[email protected]>
batman-adv: clear current gateway during teardown

Sven Eckelmann <[email protected]>
batman-adv: mcast: fix use-after-free in orig_node RCU release

Harry Wentland <[email protected]>
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

Harry Wentland <[email protected]>
drm/amd/display: Validate GPIO pin LUT table size before iterating

Harry Wentland <[email protected]>
drm/amd/display: Fix integer overflow in bios_get_image()

Osama Abdelkader <[email protected]>
drm/bridge: megachips: remove bridge when irq request fails

Julien Chauveau <[email protected]>
drm/bridge: it66121: acquire reset GPIO in probe

Deepanshu Kartikey <[email protected]>
drm/virtio: use uninterruptible resv lock for plane updates

Bartosz Golaszewski <[email protected]>

    device property: set fwnode->secondary to NULL in fwnode_init()

Huacai Chen <[email protected]>
LoongArch: Remove unused code to avoid build warning

Michael Bommarito <[email protected]>
RDMA/siw: Reject MPA FPDU length underflow before signed receive math

Johan Hovold <[email protected]>
spi: ti-qspi: fix use-after-free after DMA setup failure

Johan Hovold <[email protected]>
spi: sprd: fix error pointer deref after DMA setup failure

Michael Bommarito <[email protected]>
scsi: isci: Fix use-after-free in device removal path

Wayne Chang <[email protected]>
phy: tegra: xusb: Fix per-pad high-speed termination calibration

Johan Hovold <[email protected]>
spi: qup: fix error pointer deref after DMA setup failure

Osama Abdelkader <[email protected]>
drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe

Michael Bommarito <[email protected]>
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Vladimir Murzin <[email protected]>
arm64: probes: Handle probes on hinted conditional branch instructions

Masami Hiramatsu (Google) <[email protected]>

    tracing: Do not call map->ops->elt_free() if elt_alloc() fails

Zhihao Cheng <[email protected]>
cifs: Fix busy dentry used after unmounting

John Walker <[email protected]>

    wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

Marcin Szycik <[email protected]>
ice: fix setting promisc mode while adding VID filter

Michael Bommarito <[email protected]>
ixgbevf: fix use-after-free in VEPA multicast source pruning

Michael Bommarito <[email protected]>
ipv4: raw: reject IP_HDRINCL packets with ihl < 5

Kyle Farnung <[email protected]>
wifi: ath11k: clear shared SRNG pointer state on restart

Stefano Garzarella <[email protected]>
vsock/virtio: reset connection on receiving queue overflow

Minh Nguyen <[email protected]>
vsock/vmci: fix UAF when peer resets connection during handshake

Steven Rostedt <[email protected]>
ring-buffer: Fix reporting of missed events in iterator

Dawei Feng <[email protected]>
qed: fix double free in qed_cxt_tables_alloc()

Yizhou Zhao <[email protected]>
netfilter: nft_inner: Fix IPv6 inner_thoff desync

Nan Li <[email protected]>
netfilter: ipset: stop hash:* range iteration at end

Haoze Xie <[email protected]>

    netfilter: nf_queue: hold bridge skb->dev while queued

Zhengchuan Liang <[email protected]>
netfilter: ip6t_hbh: reject oversized option lists

Michael Bommarito <[email protected]>
net: ifb: report ethtool stats over num_tx_queues

Nicolai Buchwitz <[email protected]>
net: bcmgenet: keep RBUF EEE/PM disabled

Zijing Yin <[email protected]>
phonet/pep: disable BH around forwarded sk_receive_skb()

Jiexun Wang <[email protected]>
Bluetooth: serialize accept_q access

Michael Bommarito <[email protected]>
Bluetooth: MGMT: validate Add Extended Advertising Data length

Mingyu Wang <[email protected]>
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

Jann Horn <[email protected]>

    Bluetooth: bnep: Fix UAF read of dev->name

David Carlier <[email protected]>
Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

Safa Karakuş <[email protected]>
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

Abdun Nihaal <[email protected]>
net: wwan: iosm: fix potential memory leaks in ipc_imem_init()

Muchun Song <[email protected]>
drivers/base/memory: fix memory block reference leak in poison accounting

Ard Biesheuvel <[email protected]>
efi: Allocate runtime workqueue before ACPI init

Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access at reading cache

Takashi Iwai <[email protected]>
ALSA: pcm: Don't setup bogus iov_iter for silencing

Cássio Gabriel <[email protected]>
ALSA: ua101: Reject too-short USB descriptors

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

ChenXiaoSong <[email protected]>
smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close

Henrique Carvalho <[email protected]>
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

Ferry Meng <[email protected]>
ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow

Jeremy Laratro <[email protected]>
ksmbd: fix null pointer dereference in compare_guid_key()

SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()

Greg Kroah-Hartman <[email protected]>
sysfs: don't remove existing directory on update failure

Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue

Sasha Levin <[email protected]>
Revert "af_unix: Reject SIOCATMARK on non-stream sockets"

Sasha Levin <[email protected]>
Revert "s390/cio: Update purge function to unregister the unused subchannels"

Sasha Levin <[email protected]>
Revert "ice: Remove jumbo_remove step from TX path"

Sasha Levin <[email protected]>
Revert "ice: fix double-free of tx_buf skb"

Asim Viladi Oglu Manizada <[email protected]>
smb: client: reject userspace cifs.spnego descriptions

Kuniyuki Iwashima <[email protected]>
af_unix: Give up GC if MSG_PEEK intervened.

DaeMyung Kang <[email protected]>
ksmbd: close durable scavenger races against m_fp_list lookups

Namjae Jeon <[email protected]>
ksmbd: validate owner of durable handle on reconnect

Namjae Jeon <[email protected]>
ksmbd: add durable scavenger timer

Namjae Jeon <[email protected]>
ksmbd: avoid reclaiming expired durable opens by the client

Sasha Levin <[email protected]>
Revert "x86/vdso: Fix output operand size of RDPID"

Deepanshu Kartikey <[email protected]>

    wifi: mac80211: check tdls flag in ieee80211_tdls_oper

Pengpeng Hou <[email protected]>
s390/debug: Reject zero-length input before trimming a newline

Danilo Krummrich <[email protected]>
driver core: platform: use generic driver_override infrastructure

Danilo Krummrich <[email protected]>
driver core: generalize driver_override in struct device

Fabian Godehardt <[email protected]>
spi: spidev: fix lock inversion between spi_lock and buf_lock

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: free sk if last

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: allow ID 0

Gang Yan <[email protected]>

    mptcp: sync the msk->sndbuf at accept() time

-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/mach-versatile/integrator_cp.c            |  13 +-
 arch/arm64/include/asm/insn.h                      |   2 +-
 arch/arm64/kvm/vgic/vgic-its.c                     |   4 +
 arch/loongarch/kernel/kprobes.c                    |   4 +-
 arch/loongarch/mm/init.c                           |   4 -
 arch/powerpc/kernel/time.c                         |   6 +-
 arch/s390/kernel/debug.c                           |   3 +
 arch/x86/include/asm/segment.h                     |   8 +-
 arch/x86/xen/setup.c                               |   2 +-
 drivers/accel/qaic/qaic_data.c                     |  23 +-
 drivers/base/bus.c                                 |  43 ++-
 drivers/base/core.c                                |   2 +
 drivers/base/dd.c                                  |  60 ++++
 drivers/base/memory.c                              |   8 +-
 drivers/base/platform.c                            |  37 +--
 drivers/bluetooth/btmtk.c                          | 295 +++++++++++++++++-
 drivers/bluetooth/btmtk.h                          |  41 ++-
 drivers/bluetooth/btmtksdio.c                      |   1 +
 drivers/bluetooth/btmtkuart.c                      |   1 +
 drivers/bluetooth/btusb.c                          | 338 +++------------------
 drivers/bluetooth/hci_ldisc.c                      |  48 ++-
 drivers/bus/simple-pm-bus.c                        |   4 +-
 drivers/clk/imx/clk-scu.c                          |   3 +-
 drivers/firmware/arm_ffa/bus.c                     |   4 +-
 drivers/firmware/arm_ffa/driver.c                  |   2 +-
 drivers/firmware/efi/efi.c                         |  28 +-
 drivers/gpio/gpiolib-cdev.c                        |  21 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |   9 +
 .../drm/amd/display/dc/bios/bios_parser_helper.c   |   9 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   6 +-
 drivers/gpu/drm/bridge/chipone-icn6211.c           |   4 +-
 drivers/gpu/drm/bridge/ite-it66121.c               |   5 +
 .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c   |  16 +-
 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c  |  24 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   1 +
 drivers/gpu/drm/msm/msm_iommu.c                    |   5 +-
 drivers/gpu/drm/virtio/virtgpu_drv.h               |   1 +
 drivers/gpu/drm/virtio/virtgpu_gem.c               |  17 ++
 drivers/gpu/drm/virtio/virtgpu_plane.c             |  10 +-
 drivers/hid/hid-quirks.c                           |   2 +-
 drivers/hid/hid-uclogic-core.c                     |   4 +-
 drivers/hwmon/pmbus/adm1266.c                      |  32 +-
 drivers/i3c/master/mipi-i3c-hci/dma.c              |  25 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |  15 +
 drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c       |   2 +-
 drivers/irqchip/irq-ath79-cpu.c                    |   7 -
 drivers/net/dsa/mt7530.c                           |  79 ++---
 drivers/net/dsa/mt7530.h                           |  70 ++---
 drivers/net/ethernet/amd/pds_core/debugfs.c        |   7 +-
 drivers/net/ethernet/amd/pds_core/dev.c            |  11 +-
 drivers/net/ethernet/amd/pds_core/devlink.c        |   8 +-
 drivers/net/ethernet/atheros/ag71xx.c              |   3 +
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   9 +-
 drivers/net/ethernet/cirrus/cs89x0.c               |   2 -
 drivers/net/ethernet/cortina/gemini.c              |  21 +-
 drivers/net/ethernet/intel/ice/ice_dcb_lib.c       |   4 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |   2 +-
 drivers/net/ethernet/intel/ice/ice_txrx.c          |   7 +-
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c  |   1 +
 .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c |   3 +-
 .../net/ethernet/microchip/lan966x/lan966x_main.c  |   8 +-
 drivers/net/ethernet/microsoft/mana/hw_channel.c   |  35 ++-
 drivers/net/ethernet/qlogic/qed/qed_cxt.c          |   2 +
 drivers/net/ifb.c                                  |  11 +-
 drivers/net/phy/dp83tc811.c                        |   1 +
 drivers/net/phy/phy-c45.c                          | 129 ++++----
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   3 +-
 drivers/net/wireless/ath/ath11k/hal.c              |  14 +-
 drivers/net/wireless/ath/ath11k/hal_rx.c           |   5 +-
 drivers/net/wireless/ath/ath11k/testmode.c         |   1 +
 drivers/net/wireless/ath/ath11k/wmi.c              |  19 +-
 drivers/net/wwan/iosm/iosm_ipc_imem.c              |   2 +
 drivers/phy/marvell/phy-mvebu-a3700-utmi.c         |   5 +-
 drivers/phy/tegra/xusb-tegra186.c                  |  33 +-
 drivers/phy/tegra/xusb.h                           |   1 +
 drivers/pinctrl/qcom/pinctrl-sm8150.c              |   8 +-
 drivers/platform/x86/adv_swbutton.c                |   6 +-
 drivers/platform/x86/hp/hp_accel.c                 |   3 +
 drivers/platform/x86/intel/hid.c                   |   6 +-
 drivers/platform/x86/intel/vbtn.c                  |   6 +-
 drivers/s390/cio/device.c                          |  37 +--
 drivers/scsi/isci/host.c                           |   3 +
 drivers/slimbus/qcom-ngd-ctrl.c                    |   6 +-
 drivers/spi/spi-mtk-snfi.c                         |   2 +-
 drivers/spi/spi-qup.c                              |   3 +
 drivers/spi/spi-sprd.c                             |   3 +-
 drivers/spi/spi-ti-qspi.c                          |   1 +
 drivers/spi/spidev.c                               |  63 ++--
 fs/netfs/iterator.c                                |  26 +-
 fs/smb/client/cifs_spnego.c                        |  16 +
 fs/smb/client/cifsfs.c                             |   2 +
 fs/smb/client/smb2transport.c                      |   2 +
 fs/smb/server/mgmt/user_session.c                  |  10 +-
 fs/smb/server/oplock.c                             |  13 +-
 fs/smb/server/oplock.h                             |   1 +
 fs/smb/server/server.c                             |   1 +
 fs/smb/server/server.h                             |   1 +
 fs/smb/server/smb2pdu.c                            |   5 +-
 fs/smb/server/smb2pdu.h                            |   2 +
 fs/smb/server/smbacl.c                             |  12 +-
 fs/smb/server/vfs_cache.c                          | 325 ++++++++++++++++++--
 fs/smb/server/vfs_cache.h                          |  15 +-
 fs/sysfs/group.c                                   |   2 +-
 fs/zonefs/super.c                                  |   6 +-
 include/asm-generic/kprobes.h                      |   2 +-
 include/linux/device.h                             |  54 ++++
 include/linux/device/bus.h                         |   4 +
 include/linux/fwnode.h                             |   1 +
 include/linux/netfilter/x_tables.h                 |   3 +-
 include/linux/netfilter_arp/arp_tables.h           |   1 -
 include/linux/netfilter_ipv4/ip_tables.h           |   1 -
 include/linux/netfilter_ipv6/ip6_tables.h          |   1 -
 include/linux/phy.h                                |   1 +
 include/linux/platform_device.h                    |   5 -
 include/linux/sched/task.h                         |   2 +
 include/linux/spinlock.h                           |  26 ++
 include/linux/string.h                             |  12 +
 include/net/af_unix.h                              |   1 +
 include/net/bluetooth/bluetooth.h                  |   1 +
 include/net/netfilter/nf_queue.h                   |   1 +
 include/trace/events/btrfs.h                       |   4 +-
 kernel/irq_work.c                                  |   7 +
 kernel/ptrace.c                                    | 154 +++++-----
 kernel/trace/ring_buffer.c                         |   8 +-
 kernel/trace/trace_events_hist.c                   |   6 +-
 kernel/trace/tracing_map.c                         |  17 +-
 lib/kunit/Kconfig                                  |   5 +-
 lib/test_kprobes.c                                 |  29 +-
 mm/damon/sysfs-schemes.c                           |   1 +
 net/batman-adv/bridge_loop_avoidance.c             |  54 ++--
 net/batman-adv/distributed-arp-table.c             |   3 +
 net/batman-adv/fragmentation.c                     |  58 +++-
 net/batman-adv/gateway_client.c                    |   4 +
 net/batman-adv/originator.c                        |   4 +-
 net/batman-adv/tp_meter.c                          |  64 ++--
 net/batman-adv/types.h                             |  17 +-
 net/bluetooth/af_bluetooth.c                       |  99 ++++--
 net/bluetooth/bnep/core.c                          |   2 +-
 net/bluetooth/iso.c                                |  14 +-
 net/bluetooth/l2cap_sock.c                         |  51 +++-
 net/bluetooth/mgmt.c                               |   6 +
 net/bluetooth/rfcomm/sock.c                        |   9 +-
 net/bluetooth/sco.c                                |   9 +-
 net/bridge/br_multicast.c                          |  27 +-
 net/bridge/netfilter/Kconfig                       |  13 +
 net/bridge/netfilter/Makefile                      |   2 +-
 net/bridge/netfilter/ebtable_broute.c              |  14 +-
 net/bridge/netfilter/ebtable_filter.c              |  14 +-
 net/bridge/netfilter/ebtable_nat.c                 |  12 +-
 net/bridge/netfilter/ebtables.c                    |  71 +++--
 net/core/gro.c                                     |   3 +
 net/core/skmsg.c                                   |   9 +-
 net/ethtool/bitset.c                               |   8 +-
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/netfilter/Kconfig                         |  59 ++--
 net/ipv4/netfilter/Makefile                        |   2 +-
 net/ipv4/netfilter/arp_tables.c                    |  18 +-
 net/ipv4/netfilter/arptable_filter.c               |  27 +-
 net/ipv4/netfilter/ip_tables.c                     |  18 +-
 net/ipv4/netfilter/iptable_filter.c                |  27 +-
 net/ipv4/netfilter/iptable_mangle.c                |  29 +-
 net/ipv4/netfilter/iptable_nat.c                   |   6 +-
 net/ipv4/netfilter/iptable_raw.c                   |  26 +-
 net/ipv4/netfilter/iptable_security.c              |  27 +-
 net/ipv4/raw.c                                     |   2 +-
 net/ipv6/netfilter/Kconfig                         |  30 +-
 net/ipv6/netfilter/Makefile                        |   2 +-
 net/ipv6/netfilter/ip6_tables.c                    |  18 +-
 net/ipv6/netfilter/ip6t_hbh.c                      |   4 +
 net/ipv6/netfilter/ip6table_filter.c               |  26 +-
 net/ipv6/netfilter/ip6table_mangle.c               |  27 +-
 net/ipv6/netfilter/ip6table_nat.c                  |   6 +-
 net/ipv6/netfilter/ip6table_raw.c                  |  24 +-
 net/ipv6/netfilter/ip6table_security.c             |  27 +-
 net/mac80211/tdls.c                                |   2 +-
 net/mptcp/pm_netlink.c                             |  35 +--
 net/mptcp/protocol.c                               |   3 +-
 net/netfilter/Kconfig                              |  22 +-
 net/netfilter/ipset/ip_set_hash_ipmark.c           |   6 +-
 net/netfilter/ipset/ip_set_hash_ipport.c           |   5 +-
 net/netfilter/ipset/ip_set_hash_ipportip.c         |   5 +-
 net/netfilter/ipset/ip_set_hash_ipportnet.c        |   5 +-
 net/netfilter/nf_queue.c                           |   4 +-
 net/netfilter/nfnetlink_queue.c                    |   2 +
 net/netfilter/nft_inner.c                          |   1 -
 net/netfilter/x_tables.c                           | 116 +++++--
 net/phonet/pep.c                                   |  19 +-
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc_tracepoint.h                           |   2 +-
 net/tls/tls_sw.c                                   |  46 ++-
 net/unix/af_unix.c                                 |   5 +-
 net/unix/garbage.c                                 |  79 +++--
 net/vmw_vsock/virtio_transport_common.c            |  20 +-
 net/vmw_vsock/vmci_transport.c                     |   2 +-
 net/wireless/scan.c                                |   3 +
 sound/core/pcm_lib.c                               |   3 +
 sound/core/seq/seq_ump_client.c                    |  35 ++-
 sound/pci/asihpi/hpicmn.c                          |   6 +
 sound/pci/hda/cs35l56_hda.c                        |   1 +
 sound/soc/codecs/cs35l56-sdw.c                     |   3 +-
 sound/soc/samsung/i2s.c                            |   6 +-
 sound/usb/misc/ua101.c                             |   5 +-
 203 files changed, 2704 insertions(+), 1346 deletions(-)

Read the cover letter in its thread