6.6.153-rc1 review

Greg Kroah-Hartman linux-patches linux-tegra lkml stable 1 version Aug 20 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Aug 20166 patches 14 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/166	block: stop the timeout timer when releasing a never added disk`block/genhd.c`	+8 -4	0 replies
2/166	f2fs: fix UAF issue in f2fs_merge_page_bio()`fs/f2fs/data.c`	+1 -1	0 replies
3/166	ipvs: separate destination availability state`include/net/ip_vs.h` `include/uapi/linux/ip_vs.h` `net/netfilter/ipvs/ip_vs_conn.c` +5 more	+21 ~~-20~~	0 replies
4/166	net: mana: Fix EQ leak in mana_remove on NULL port`drivers/net/ethernet/microsoft/mana/mana_en.c`	+2 -2	0 replies
5/166	selinux: require every boolean value to be defined`security/selinux/ss/policydb.c`	+19 -0	0 replies
6/166	selinux: reject a class permission count below its inherited common`security/selinux/ss/policydb.c`	+12 -0	0 replies
7/166	selinux: do not cancel a policy conversion that never started`security/selinux/ss/services.c`	+3 -1	0 replies
8/166	selinux: reject an unclaimed class value in security_get_classes()`security/selinux/ss/services.c`	+19 -5	0 replies
9/166	selftests: mptcp: join: mark tests with data corruption as failed`tools/testing/selftests/net/mptcp/mptcp_join.sh`	+2 -2	0 replies
10/166	mptcp: avoid combining some incoming suboptions`net/mptcp/options.c` `net/mptcp/protocol.h`	+59 -1	0 replies
11/166	mptcp: options: reset DSS fields in case of unexpected size`net/mptcp/options.c`	+7 -1	0 replies
12/166	mptcp: fastopen: only mark MPTFO subflows with SYN data`net/mptcp/fastopen.c`	+4 -3	0 replies
13/166	s390/qeth: validate user buffer length in SNMP and ARP query ioctls`drivers/s390/net/qeth_core_main.c` `drivers/s390/net/qeth_l3_main.c`	+8 -0	0 replies
14/166	ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()`sound/soc/sof/sof-audio.c`	+4 -5	0 replies
15/166	ASoC: cs4265: sort the register default table`sound/soc/codecs/cs4265.c`	+2 -2	0 replies
16/166	ASoC: cs35l45: sort the register default table`sound/soc/codecs/cs35l45-tables.c`	+16 ~~-16~~	0 replies
17/166	ASoC: cs35l41: sort the register default table`sound/soc/codecs/cs35l41-lib.c`	+1 -1	0 replies
18/166	ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses`sound/soc/codecs/lpass-wsa-macro.c`	+4 -4	0 replies
19/166	fbdev: core: Fix pointer desynchronization in fb_io_read()`drivers/video/fbdev/core/fb_io_fops.c`	+8 -0	0 replies
20/166	drm/amdgpu: fix aperture iounmap skipped on device removal`drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c`	+2 -8	0 replies
21/166	Input: xpad - add support for ZENAIM LEVERLESS`drivers/input/joystick/xpad.c`	+2 -0	0 replies
22/166	powerpc/pseries: pci - logic bug`arch/powerpc/platforms/pseries/pci.c`	+1 -1	0 replies
23/166	Input: synaptics-rmi4 - fix F55 transmitter electrode count typo`drivers/input/rmi4/rmi_f55.c`	+2 -2	0 replies
24/166	Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet`drivers/input/mouse/focaltech.c`	+1 -1	0 replies
25/166	Input: psxpad-spi - set driver data before use`drivers/input/joystick/psxpad-spi.c`	+1 -0	0 replies
26/166	Input: atkbd - skip deactivate for Xiaomi Book Pro 14s internal keyboard`drivers/input/keyboard/atkbd.c`	+8 -0	0 replies
27/166	Input: iforce - validate input packet lengths`drivers/input/joystick/iforce/iforce-packets.c` `drivers/input/joystick/iforce/iforce-usb.c`	+13 -1	0 replies
28/166	powerpc/pseries: lparcfg - fix kbuf[] underflow`arch/powerpc/platforms/pseries/lparcfg.c`	+1 -1	0 replies
29/166	Input: synaptics-rmi4 - zero report size on F54 work error`drivers/input/rmi4/rmi_f54.c`	+8 -8	0 replies
30/166	Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer`drivers/input/rmi4/rmi_f54.c`	+10 -2	0 replies
31/166	Input: synaptics-rmi4 - block s_input when F54 queue is busy`drivers/input/rmi4/rmi_f54.c`	+6 -1	0 replies
32/166	Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue`drivers/input/rmi4/rmi_f54.c`	+8 -0	0 replies
33/166	Input: hynitron_cstxxx - validate touch count and finger IDs`drivers/input/touchscreen/hynitron_cstxxx.c`	+10 -3	0 replies
34/166	crypto: qce - fix error path in devm_qce_register_algs`drivers/crypto/qce/core.c`	+1 -1	0 replies
35/166	libceph: fix multiple unsafe decodes in decode_locker()`net/ceph/cls_lock_client.c`	+9 -4	0 replies
36/166	ftrace: Protect direct_functions in ftrace_find_rec_direct`kernel/trace/ftrace.c`	+2 -1	0 replies
37/166	ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()`kernel/trace/ftrace.c`	+5 -1	0 replies
38/166	openrisc: signal: do not restore privileged SR bits on sigreturn`arch/openrisc/include/asm/processor.h` `arch/openrisc/kernel/signal.c`	+5 -2	0 replies
39/166	Input: sur40 - fix input device registration ordering`drivers/input/touchscreen/sur40.c`	+11 ~~-10~~	0 replies
40/166	Input: sur40 - fix V4L error path cleanup`drivers/input/touchscreen/sur40.c`	+3 -1	0 replies
41/166	libceph: Avoid using invalid osd indices from primary_temp`net/ceph/osdmap.c`	+3 -2	0 replies
42/166	ceph: fix MDS random selection readiness predicate`fs/ceph/mdsmap.c`	+1 -1	0 replies
43/166	libceph: tolerate addrvecs with multiple entries of the same type`net/ceph/decode.c`	+9 -9	0 replies
44/166	mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit`drivers/mmc/host/omap_hsmmc.c`	+1 -1	0 replies
45/166	mmc: sdhci: unmap the bounce buffer before device release`drivers/mmc/host/sdhci.c`	+16 -0	0 replies
46/166	mmc: sdhci: make tuning_err a signed int`drivers/mmc/host/sdhci.h`	+1 -1	0 replies
47/166	mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition`drivers/mmc/host/atmel-mci.c`	+2 -0	0 replies
48/166	drm/radeon: fix autosuspend cleanup during teardown`drivers/gpu/drm/radeon/radeon_kms.c`	+1 -0	0 replies
49/166	s390/vfio_ccw: Free all memory if cp_init() fails`drivers/s390/cio/vfio_ccw_cp.c`	+18 -4	0 replies
50/166	s390/vfio_ccw: Limit the number of channel program segments`drivers/s390/cio/vfio_ccw_cp.c` `drivers/s390/cio/vfio_ccw_cp.h`	+14 -0	0 replies
51/166	s390/vfio_ccw: Cancel existing workqueues`drivers/s390/cio/vfio_ccw_ops.c`	+15 -0	0 replies
52/166	s390/vfio_ccw: Ensure index for read/write regions are within range`drivers/s390/cio/vfio_ccw_async.c` `drivers/s390/cio/vfio_ccw_chp.c` `drivers/s390/cio/vfio_ccw_ops.c`	+34 -4	0 replies
53/166	s390/vfio_ccw: Fix out of bounds check on CCW array`drivers/s390/cio/vfio_ccw_cp.c`	+5 ~~-12~~	0 replies
54/166	s390/vfio_ccw: Move cp cleanup out of not operational`drivers/s390/cio/vfio_ccw_drv.c` `drivers/s390/cio/vfio_ccw_fsm.c` `drivers/s390/cio/vfio_ccw_ops.c` +1 more	+26 -2	0 replies
55/166	s390/vfio_ccw: Selectively expand io_mutex`drivers/s390/cio/vfio_ccw_chp.c` `drivers/s390/cio/vfio_ccw_cp.c` `drivers/s390/cio/vfio_ccw_drv.c` +2 more	+19 -5	0 replies
56/166	drm/amdgpu: Reject UVD message with invalid number of h265 refs`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+3 -0	0 replies
57/166	drm/amdgpu: validate GEM_CREATE domain combinations`drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c`	+21 -0	0 replies
58/166	drm/amdgpu: Reject UVD message with dimensions above 4096`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+2 -2	0 replies
59/166	drm/amdgpu: Implement insert_end for VCE 3`drivers/gpu/drm/amd/amdgpu/vce_v3_0.c`	+22 -4	0 replies
60/166	drm/amdgpu: Fix UVD min buffer sizes`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+7 -5	0 replies
61/166	drm/amdgpu: Fix UVD dpb min size calculation for H264`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+4 ~~-58~~	0 replies
62/166	drm/amdgpu: Fix UVD decode image min size calculation`drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c`	+2 -2	0 replies
63/166	drm/amdgpu: disallow multiple FENCE chunks in one submit`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c`	+4 -0	0 replies
64/166	xfs: only check mergeability of bnobt records`fs/xfs/scrub/alloc.c`	+3 -2	0 replies
65/166	xfs: fix ilock leak on error in xfs_dq_get_next_id`fs/xfs/xfs_dquot.c`	+2 -1	0 replies
66/166	xfs: dont swallow dquot recovery verification errors`fs/xfs/xfs_dquot_item_recover.c`	+1 -1	0 replies
67/166	xfs: check v5 superblock features early`fs/xfs/libxfs/xfs_sb.c`	+2 -2	0 replies
68/166	RISC-V: Provide pgtable_l5_enabled on rv32`arch/riscv/include/asm/pgtable-32.h` `arch/riscv/include/asm/pgtable.h` `arch/riscv/mm/init.c`	+5 -1	0 replies
69/166	selftests: tls: add test with a partially invalid iov`tools/testing/selftests/net/tls.c`	+34 -0	0 replies
70/166	ceph: avoid fs reclaim while using current->journal_info`fs/ceph/mds_client.c`	+11 -0	0 replies
71/166	ceph: Remove ceph_writepage()`fs/ceph/addr.c`	+1 ~~-27~~	0 replies
72/166	ceph: fix hanging __ceph_get_caps() with stale mds_wanted`fs/ceph/caps.c` `fs/ceph/file.c` `fs/ceph/mds_client.h`	+22 -6	0 replies
73/166	ceph: Use a folio in ceph_page_mkwrite()`fs/ceph/addr.c`	+13 ~~-13~~	0 replies
74/166	libceph: Amend checking to fix `make W=1` build breakage`net/ceph/osdmap.c`	+2 -2	0 replies
75/166	libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE`net/ceph/osdmap.c`	+2 -2	0 replies
76/166	ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP`sound/soc/fsl/fsl_sai.c`	+25 -4	0 replies
77/166	iomap: hold state_lock over call to ifs_set_range_uptodate()`fs/iomap/buffered-io.c`	+11 -9	0 replies
78/166	iomap: fix out-of-bounds bitmap_set() with zero-length range`fs/iomap/buffered-io.c`	+14 -8	0 replies
79/166	mm: userfaultfd: add pgtable_supports_uffd_wp()`fs/userfaultfd.c` `include/asm-generic/pgtable_uffd.h` `include/linux/mm_inline.h` +1 more	+36 ~~-16~~	0 replies
80/166	userfaultfd: move vma_can_userfault out of line`include/linux/userfaultfd_k.h` `mm/userfaultfd.c`	+21 ~~-20~~	0 replies
81/166	userfaultfd: prevent registration of special VMAs`mm/userfaultfd.c`	+6 -0	0 replies
82/166	libceph: fix two unsafe bare decodes in decode_lockers()`net/ceph/cls_lock_client.c`	+6 -2	0 replies
83/166	net: move skb_gro_receive_list from udp to core`include/net/gro.h` `net/core/gro.c` `net/ipv4/udp_offload.c`	+30 ~~-29~~	0 replies
84/166	net: gro: fix double aggregation of flush-marked skbs`net/core/gro.c`	+3 -1	0 replies
85/166	net/sched: serialize qdisc_rtab_list against concurrent get/put`net/sched/sch_api.c`	+19 -5	0 replies
86/166	super: fix emergency thaw deadlock on frozen block devices`fs/super.c`	+15 -7	0 replies
87/166	smb: move smb_version_values to common/smbglob.h`fs/smb/client/cifsglob.h` `fs/smb/common/cifsglob.h` `fs/smb/server/smb2misc.c` +3 more	+53 ~~-72~~	0 replies
88/166	smb: move get_rfc1002_len() to common/smbglob.h`fs/smb/client/cifsglob.h` `fs/smb/client/cifssmb.c` `fs/smb/client/connect.c` +3 more	+13 ~~-19~~	0 replies
89/166	smb/server: rename include guard in smb_common.h`fs/smb/server/smb_common.h`	+3 -3	0 replies
90/166	ksmbd: rename smb2_get_msg to smb_get_msg`fs/smb/server/auth.c` `fs/smb/server/connection.c` `fs/smb/server/oplock.c` +4 more	+54 ~~-54~~	0 replies
91/166	smb/server: fix minimum SMB1 PDU size`fs/smb/server/connection.c`	+3 -2	0 replies
92/166	smb/server: fix minimum SMB2 PDU size`fs/smb/server/connection.c`	+2 -2	0 replies
93/166	ksmbd: validate minimum PDU size for transform requests`fs/smb/server/connection.c`	+11 -5	0 replies
94/166	tcp: Pass flags to __tcp_send_ack`include/net/tcp.h` `net/ipv4/bpf_tcp_ca.c` `net/ipv4/tcp_dctcp.h` +1 more	+6 -6	0 replies
95/166	tcp: fast path functions later`include/net/tcp.h`	+27 ~~-27~~	0 replies
96/166	tcp: challenge ACK for non-exact RST in SYN-RECEIVED`include/net/tcp.h` `net/ipv4/tcp_input.c` `net/ipv4/tcp_minisocks.c`	+56 ~~-14~~	0 replies
97/166	btrfs: add debug build only WARN`fs/btrfs/messages.h`	+7 -0	0 replies
98/166	btrfs: add space_info argument to btrfs_chunk_alloc()`fs/btrfs/block-group.c` `fs/btrfs/block-group.h` `fs/btrfs/extent-tree.c` +2 more	+27 ~~-16~~	0 replies
99/166	btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()`fs/btrfs/block-group.c` `fs/btrfs/zoned.c` `fs/btrfs/zoned.h`	+6 -9	0 replies
100/166	btrfs: zoned: fix missing chunk metadata reservation`fs/btrfs/block-group.c`	+19 ~~-15~~	0 replies
101/166	mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE`mm/migrate_device.c`	+3 -2	0 replies
102/166	ice: make use of DEFINE_FLEX() in ice_switch.c`drivers/net/ethernet/intel/ice/ice_switch.c`	+14 ~~-49~~	0 replies
103/166	ice: make ice_vsi_cfg_rxq() static`drivers/net/ethernet/intel/ice/ice_base.c` `drivers/net/ethernet/intel/ice/ice_base.h` `drivers/net/ethernet/intel/ice/ice_lib.c` +2 more	+60 ~~-63~~	0 replies
104/166	overflow: Change DEFINE_FLEX to take __counted_by member`drivers/net/ethernet/intel/ice/ice_switch.c` `include/linux/overflow.h` `lib/overflow_kunit.c`	+76 -5	0 replies
105/166	Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings`include/net/bluetooth/hci.h` `net/bluetooth/hci_event.c` `net/bluetooth/hci_sync.c`	+40 ~~-55~~	0 replies
106/166	Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1`include/net/bluetooth/hci_core.h` `net/bluetooth/hci_core.c` `net/bluetooth/hci_sync.c`	+19 ~~-10~~	0 replies
107/166	Bluetooth: eir: Fix possible crashes on eir_create_adv_data`net/bluetooth/eir.c` `net/bluetooth/eir.h` `net/bluetooth/hci_sync.c`	+8 -6	0 replies
108/166	Bluetooth: hci_sync: Fix advertising data UAFs`net/bluetooth/hci_sync.c`	+97 ~~-34~~	0 replies
109/166	ASoC: tas2562: Validate values for volume writes`sound/soc/codecs/tas2562.c`	+7 -2	0 replies
110/166	igc: remove napi_synchronize() in igc_down()`drivers/net/ethernet/intel/igc/igc_main.c`	+0 -1	0 replies
111/166	ksmbd: conn lock to serialize smb2 negotiate`fs/smb/server/smb2pdu.c`	+2 -0	0 replies
112/166	ksmbd: reject repeated SMB2 NEGOTIATE requests`fs/smb/server/connection.h` `fs/smb/server/smb2pdu.c` `fs/smb/server/smb_common.c`	+37 ~~-15~~	0 replies
113/166	net: pktgen: fix code style (WARNING: Block comments)`net/core/pktgen.c`	+23 ~~-16~~	0 replies
114/166	net: pktgen: fix proc entry use-after-free`net/core/pktgen.c`	+1 -3	0 replies
115/166	veth: convert frag_list skbs before running XDP`drivers/net/veth.c`	+2 -2	0 replies
116/166	fs: dont block write during exec on pre-content watched files`fs/binfmt_elf.c` `fs/binfmt_elf_fdpic.c` `fs/exec.c` +2 more	+25 ~~-13~~	0 replies
117/166	binfmt_misc: restore write access when removing an entry`fs/binfmt_misc.c`	+3 -1	0 replies
118/166	ice: fix VF interrupts cleanup`drivers/net/ethernet/intel/ice/ice_vf_lib.c` `drivers/net/ethernet/intel/ice/ice_vf_lib_private.h` `drivers/net/ethernet/intel/ice/ice_virtchnl.c`	+49 -0	0 replies
119/166	vxlan: Do not alloc tstats manually`drivers/net/vxlan/vxlan_core.c`	+2 ~~-11~~	0 replies
120/166	net: core,vrf: Change pcpu_dstat fields to u64_stats_t`drivers/net/vrf.c` `include/linux/netdevice.h`	+28 ~~-22~~	0 replies
121/166	vrf: Make pcpu_dstats update functions available to other modules.`drivers/net/vrf.c` `include/linux/netdevice.h`	+54 ~~-35~~	0 replies
122/166	vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.`drivers/net/vxlan/vxlan_core.c`	+14 ~~-14~~	0 replies
123/166	vxlan: use pskb_network_may_pull() for transmit path header pulls`drivers/net/vxlan/vxlan_core.c` `drivers/net/vxlan/vxlan_mdb.c`	+5 -5	0 replies
124/166	i2c: bcm-iproc: remove printout on handled timeouts`drivers/i2c/busses/i2c-bcm-iproc.c`	+0 -2	0 replies
125/166	i2c: iproc: reset bus after timeout if START_BUSY is stuck`drivers/i2c/busses/i2c-bcm-iproc.c`	+11 -0	0 replies
126/166	can: rcar_canfd: change the initializing flow for clocks and resets`drivers/net/can/rcar/rcar_canfd.c`	+14 ~~-14~~	0 replies
127/166	drm/amd/pm: fix torn gpu metrics reads`drivers/gpu/drm/amd/pm/amdgpu_dpm.c` `drivers/gpu/drm/amd/pm/amdgpu_pm.c` `drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h`	+12 ~~-11~~	0 replies
128/166	drm/amd/pm: fix pptable use-after-free`drivers/gpu/drm/amd/pm/amdgpu_dpm.c` `drivers/gpu/drm/amd/pm/amdgpu_pm.c` `drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h`	+16 ~~-10~~	0 replies
129/166	drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c`	+16 ~~-14~~	0 replies
130/166	mm/pagewalk: split walk_page_range_novma() into kernel/user parts`arch/openrisc/kernel/dma.c` `arch/riscv/mm/pageattr.c` `include/linux/pagewalk.h` +3 more	+83 ~~-18~~	0 replies
131/166	mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF`include/linux/mmap_lock.h` `mm/pagewalk.c` `mm/vmalloc.c`	+56 ~~-19~~	0 replies
132/166	mm/ptdump: always stabilise against page table freeing using init_mm`mm/pagewalk.c` `mm/ptdump.c`	+16 -5	0 replies
133/166	KVM: SVM: Serialize accesses to the owner and mirror list with separate lock`arch/x86/kvm/svm/sev.c` `arch/x86/kvm/svm/svm.h`	+26 -9	0 replies
134/166	selftests: tls: add rekey tests`tools/testing/selftests/net/tls.c`	+458 -0	0 replies
135/166	tls: rx: restore msg_iter before TLS 1.3 optimistic retry`net/tls/tls_sw.c` `tools/testing/selftests/net/tls.c`	+59 -0	0 replies
136/166	mm/huge_memory: fix huge_zero_pfn race`mm/huge_memory.c`	+29 ~~-14~~	0 replies
137/166	arm64: tegra: Add EL2 virtual timer interrupt for Tegra194`arch/arm64/boot/dts/nvidia/tegra194.dtsi`	+2 -0	0 replies
138/166	crypto: ccm - Set rfc4309 maxauthsize from child`crypto/ccm.c`	+1 -1	0 replies
139/166	netfilter: ipset: fix refcount race between list:set GC and swap`net/netfilter/ipset/ip_set_core.c`	+13 -6	0 replies
140/166	netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path`net/netfilter/nf_tables_offload.c`	+1 -1	0 replies
141/166	netfilter: flowtable: publish GC-visible tuple last`net/netfilter/nf_flow_table_core.c`	+4 -3	0 replies
142/166	netfilter: ipset: fix list type element drift bug`net/netfilter/ipset/ip_set_list_set.c`	+5 -2	0 replies
143/166	netfilter: ipset: let destroy callbacks adjust ext mem size`net/netfilter/ipset/ip_set_bitmap_gen.h` `net/netfilter/ipset/ip_set_list_set.c`	+2 -3	0 replies
144/166	ipvlan: inherit needed_headroom and needed_tailroom from phy_dev`drivers/net/ipvlan/ipvlan_main.c`	+4 -0	0 replies
145/166	macvlan: inherit needed_headroom and needed_tailroom from lowerdev`drivers/net/macvlan.c`	+4 -0	0 replies
146/166	net: packet: fix wrong transport_header when sending VLAN-tagged frame`net/packet/af_packet.c`	+2 -2	0 replies
147/166	net/tls: Fail tls_sw_splice_read() after a failed async decrypt`net/tls/tls_sw.c`	+5 -0	0 replies
148/166	ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers`sound/soc/xilinx/xlnx_formatter_pcm.c`	+4 -6	0 replies
149/166	af_packet: Dont send zero-byte data in tpacket_snd().`net/packet/af_packet.c`	+3 -0	0 replies
150/166	net, sched: Make tc-related drop reason more flexible`include/net/pkt_cls.h` `include/net/sch_generic.h` `net/core/dev.c`	+17 -7	0 replies
151/166	net, sched: Add tcf_set_drop_reason for {__,}tcf_classify`include/net/dropreason-core.h` `net/sched/cls_api.c`	+23 -6	0 replies
152/166	net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config`net/sched/act_api.c` `net/sched/cls_api.c`	+9 -2	0 replies
153/166	packet: add a generic drop reason for receive`include/net/dropreason-core.h` `net/packet/af_packet.c`	+13 ~~-13~~	0 replies
154/166	net: sched: Move drop_reason to struct tc_skb_cb`include/net/pkt_cls.h` `include/net/pkt_sched.h` `include/net/sch_generic.h` +3 more	+25 ~~-22~~	0 replies
155/166	net: sched: Add initial TC error skb drop reasons`include/net/dropreason-core.h` `net/sched/act_api.c` `net/sched/cls_api.c`	+31 ~~-12~~	0 replies
156/166	net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain`net/sched/act_api.c`	+5 -5	0 replies
157/166	net/sched: cls_u32: skip hash tables in u32_bind_class()`net/sched/cls_u32.c`	+3 -0	0 replies
158/166	dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol`arch/arm/Kconfig` `arch/m68k/Kconfig` `arch/parisc/Kconfig` +2 more	+14 ~~-10~~	0 replies
159/166	m68k: use the coherent DMA code for coldfire without data cache`arch/m68k/Kconfig` `arch/m68k/Kconfig.cpu` `arch/m68k/kernel/Makefile` +1 more	+18 -6	0 replies
160/166	m68k: Define NR_CPUS to 1`arch/m68k/Kconfig.cpu`	+4 -0	0 replies
161/166	net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG`drivers/net/ethernet/ti/am65-cpsw-nuss.c`	+2 -0	0 replies
162/166	net/sched: cls_bpf: reject dev-bound programs bound to a different device`net/sched/cls_bpf.c`	+16 -2	0 replies
163/166	erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms`fs/erofs/Kconfig`	+2 -1	0 replies
164/166	net/x25: fix use-after-free of the socket by its timers`net/x25/af_x25.c` `net/x25/x25_timer.c`	+18 ~~-11~~	0 replies
165/166	binfmt_misc: use exe_file_deny_write_access() for the interpreter clone`fs/binfmt_misc.c`	+8 -2	0 replies
166/166	net: harmonize tstats and dstats`include/linux/netdevice.h` `net/core/dev.c`	+15 -1	0 replies

Reviews trailers per patch

120 of 166 patches have a Reviewed-by or Acked-by.

Patch	Weidong Zhu	Christoph Hellwig	Matthieu Baerts (NGI0)	Alexandra Winter	Joe Damato	Bard Liao	Charles Keepax	Richard Fitzgerald	Srinivas Kandagatla	Lijo Lazar	Hawking Zhang	Nayna Jain	R Nageswara Sastry	Andrew Zhou	Julian Anastasov	Simon Horman	Stephen Smalley	Ilya Dryomov	Viacheslav Dubeyko	Linus Walleij	Frank Li	Farhan Ali	Matthew Rosato	Leo Liu	Christian König	Ruijing Dong	Alex Deucher	Bartosz Golaszewski	Darrick J. Wong	Xiubo Li	Alex Markuze	Jiri Olsa	Masami Hiramatsu (Google)	Hans Verkuil	Paolo Abeni	Eric Dumazet	David Ahern	Willem de Bruijn	Jamal Hadi Salim	Namjae Jeon	David Howells	Josef Bacik	David Sterba	Johannes Thumshirn	Balbir Singh	Zi Yan	Shengjiu Wang	Magnus Karlsson	Chandan Kumar Rout	Gustavo A. R. Silva	Przemek Kitszel	Cezary Rojewski	Maciej Fijalkowski	Dima Ruinskiy	Moriya Kadosh	Toke Høiland-Jørgensen	Joanne Koong	David Hildenbrand	David Hildenbrand (Red Hat)	Liam R. Howlett	Lorenzo Stoakes	Christian Brauner	Ray Jui	Claudiu Beznea	Geert Uytterhoeven	Vincent Mailhol	Kenneth Feng	Mike Rapoport (Microsoft)	Qi Zheng	Oscar Salvador	Suren Baghdasaryan	Vlastimil Babka	Dev Jain	Kiryl Shutsemau	Jozsef Kadlecsik	Hangbin Liu	Aleksandr Loktionov	Patryk Holda	Jakub Kicinski	Sabrina Dubroca	Michal Simek	Jiayuan Chen	Daniel Borkmann	Subbaraya Sundeep	Victor Nogueira	Davide Caratti	Vadim Fedorenko	Ido Schimmel	Lorenzo Bianconi	Robin Murphy	Greg Ungerer	Chintan Vankar	SJ Park	Guillaume Nault	Brett A C Sheffield	Florian Fainelli	Miguel Ojeda	Peter Schneider	Francesco Dolcini	Barry K. Nathan	Shuah Khan	Wentao Guan
Series																																																																																															T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/166	A-b	R-b
2/166
3/166															A-b
4/166																R-b
5/166																	A-b
6/166																	A-b
7/166																	A-b
8/166																	A-b
9/166			R-b
10/166
11/166
12/166			R-b
13/166				R-b	R-b
14/166						R-b
15/166							R-b	R-b
16/166							R-b	R-b
17/166							R-b	R-b
18/166									R-b
19/166
20/166										R-b	R-b
21/166
22/166												A-b	T-b
23/166
24/166
25/166
26/166														R-b
27/166
28/166												A-b	T-b
29/166
30/166
31/166																																		R-b
32/166
33/166
34/166																												R-b
35/166																		R-b
36/166																																A-b
37/166																																	A-b
38/166
39/166
40/166
41/166																		R-b
42/166																			R-b
43/166																		R-b
44/166
45/166																				R-b
46/166																					R-b
47/166
48/166
49/166																						R-b	R-b
50/166																							R-b
51/166																							R-b
52/166																							R-b
53/166																							R-b
54/166																							R-b
55/166																							R-b
56/166																								R-b
57/166																									R-b
58/166																								A-b		R-b
59/166																											A-b
60/166																								A-b		R-b
61/166																								A-b		R-b
62/166																								A-b		R-b
63/166																									R-b
64/166		R-b
65/166		R-b																											R-b
66/166		R-b																											R-b
67/166																													R-b
68/166
69/166																R-b
70/166																			R-b											R-b
71/166																			T-b R-b
72/166																															R-b
73/166																			T-b R-b
74/166																			R-b
75/166																															R-b
76/166																																															R-b
77/166
78/166		R-b																											R-b																												R-b
79/166																																																										A-b
80/166																																																											R-b	R-b
81/166																																																											A-b		R-b
82/166																			R-b
83/166																																			A-b	R-b	R-b	R-b
84/166																																						R-b
85/166																																				R-b			A-b
86/166
87/166																																								A-b
88/166																																								A-b
89/166																																								A-b
90/166
91/166																																								A-b	R-b
92/166																																								A-b	R-b
93/166
94/166																																				R-b
95/166																																				R-b
96/166																																				R-b
97/166																																										R-b
98/166																																											R-b
99/166																																											R-b	R-b
100/166																																												R-b
101/166																																													R-b	A-b
102/166
103/166																R-b																																A-b	T-b
104/166																																																		R-b	R-b
105/166
106/166
107/166
108/166
109/166																																																				R-b
110/166																																																					R-b	R-b	T-b
111/166
112/166
113/166																																																								R-b
114/166																R-b
115/166																																																								R-b																																	A-b
116/166																																																														A-b
117/166
118/166																R-b																																																													R-b	T-b
119/166																																																																																				R-b
120/166																R-b																					R-b
121/166
122/166
123/166																																																																																							R-b	R-b
124/166
125/166																																																															A-b
126/166																																																																T-b	R-b	R-b
127/166																																																																			R-b
128/166																																																																			R-b
129/166																									R-b
130/166																																																										A-b										A-b	A-b	R-b	R-b	R-b
131/166																																																											A-b									R-b					R-b	R-b
132/166																																																											A-b									R-b						R-b
133/166
134/166
135/166
136/166																																																											A-b
137/166
138/166
139/166																																																																											A-b
140/166
141/166
142/166																																																																											A-b
143/166																																																																											A-b
144/166																																																																												R-b
145/166																																																																												R-b
146/166																																						R-b
147/166																																																																															R-b	R-b
148/166																																																																																	R-b
149/166																																						R-b																																												R-b
150/166																																																																															R-b
151/166
152/166																R-b
153/166																																				R-b		R-b
154/166																R-b																																																																			A-b
155/166																R-b
156/166																																																																																					T-b	R-b
157/166																																							A-b
158/166																																																																																										R-b	R-b T-b
159/166																																																																	A-b																										R-b T-b
160/166																																																																	R-b
161/166																R-b																																																																												R-b
162/166																																																																																			A-b		T-b
163/166																																																																	T-b																												T-b
164/166
165/166
166/166																																																																																														R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 102 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 000/166] 6.6.153-rc1 review

This is the start of the stable review cycle for the 6.6.153 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.153-rc1

Paolo Abeni <[email protected]>
net: harmonize tstats and dstats

Christian Brauner <[email protected]>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Baul Lee <[email protected]>
net/x25: fix use-after-free of the socket by its timers

Gao Xiang <[email protected]>
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms

Jamal Hadi Salim <[email protected]>
net/sched: cls_bpf: reject dev-bound programs bound to a different device

Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Uwe Kleine-König <[email protected]>
m68k: Define NR_CPUS to 1

Christoph Hellwig <[email protected]>
m68k: use the coherent DMA code for coldfire without data cache

Christoph Hellwig <[email protected]>
dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol

Zhang Changzhong <[email protected]>
net/sched: cls_u32: skip hash tables in u32_bind_class()

Jamal Hadi Salim <[email protected]>

    net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

Victor Nogueira <[email protected]>
net: sched: Add initial TC error skb drop reasons

Victor Nogueira <[email protected]>
net: sched: Move drop_reason to struct tc_skb_cb

Yan Zhai <[email protected]>
packet: add a generic drop reason for receive

Jamal Hadi Salim <[email protected]>
net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config

Daniel Borkmann <[email protected]>
net, sched: Add tcf_set_drop_reason for {__,}tcf_classify

Daniel Borkmann <[email protected]>
net, sched: Make tc-related drop reason more flexible

Eric Dumazet <[email protected]>
af_packet: Don't send zero-byte data in tpacket_snd().

Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

Chuck Lever <[email protected]>
net/tls: Fail tls_sw_splice_read() after a failed async decrypt

Wei Fang <[email protected]>
net: packet: fix wrong transport_header when sending VLAN-tagged frame

Eric Dumazet <[email protected]>
macvlan: inherit needed_headroom and needed_tailroom from lowerdev

Eric Dumazet <[email protected]>
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

Florian Westphal <[email protected]>
netfilter: ipset: let destroy callbacks adjust ext mem size

Florian Westphal <[email protected]>
netfilter: ipset: fix list type element drift bug

Jérémy Jean <[email protected]>
netfilter: flowtable: publish GC-visible tuple last

Alexey Velichayshiy <[email protected]>
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Xiang Mei (Microsoft) <[email protected]>
netfilter: ipset: fix refcount race between list:set GC and swap

Herbert Xu <[email protected]>
crypto: ccm - Set rfc4309 maxauthsize from child

Jon Hunter <[email protected]>
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194

Lorenzo Stoakes (ARM) <[email protected]>
mm/huge_memory: fix huge_zero_pfn race

Jérémy Jean <[email protected]>
tls: rx: restore msg_iter before TLS 1.3 optimistic retry

Sabrina Dubroca <[email protected]>
selftests: tls: add rekey tests

Paolo Bonzini <[email protected]>
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

Lorenzo Stoakes (ARM) <[email protected]>
mm/ptdump: always stabilise against page table freeing using init_mm

Lorenzo Stoakes (ARM) <[email protected]>
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Lorenzo Stoakes <[email protected]>
mm/pagewalk: split walk_page_range_novma() into kernel/user parts

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Yang Wang <[email protected]>
drm/amd/pm: fix pptable use-after-free

Yang Wang <[email protected]>
drm/amd/pm: fix torn gpu metrics reads

Tu Nguyen <[email protected]>
can: rcar_canfd: change the initializing flow for clocks and resets

Jonas Gorski <[email protected]>
i2c: iproc: reset bus after timeout if START_BUSY is stuck

Wolfram Sang <[email protected]>
i2c: bcm-iproc: remove printout on handled timeouts

Eric Dumazet <[email protected]>
vxlan: use pskb_network_may_pull() for transmit path header pulls

Guillaume Nault <[email protected]>
vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.

Guillaume Nault <[email protected]>
vrf: Make pcpu_dstats update functions available to other modules.

Jeremy Kerr <[email protected]>
net: core,vrf: Change pcpu_dstat fields to u64_stats_t

Breno Leitao <[email protected]>
vxlan: Do not alloc tstats manually

Dawid Osuchowski <[email protected]>
ice: fix VF interrupts cleanup

Christian Brauner <[email protected]>
binfmt_misc: restore write access when removing an entry

Amir Goldstein <[email protected]>
fs: don't block write during exec on pre-content watched files

Matt Fleming <[email protected]>
veth: convert frag_list skbs before running XDP

Chengfeng Ye <[email protected]>
net: pktgen: fix proc entry use-after-free

Peter Seiderer <[email protected]>
net: pktgen: fix code style (WARNING: Block comments)

Namjae Jeon <[email protected]>
ksmbd: reject repeated SMB2 NEGOTIATE requests

Namjae Jeon <[email protected]>
ksmbd: conn lock to serialize smb2 negotiate

David Carlier <[email protected]>
igc: remove napi_synchronize() in igc_down()

Mark Brown <[email protected]>
ASoC: tas2562: Validate values for volume writes

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix advertising data UAFs

Luiz Augusto von Dentz <[email protected]>
Bluetooth: eir: Fix possible crashes on eir_create_adv_data

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1

Gustavo A. R. Silva <[email protected]>
Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings

Kees Cook <[email protected]>
overflow: Change DEFINE_FLEX to take __counted_by member

Maciej Fijalkowski <[email protected]>
ice: make ice_vsi_cfg_rxq() static

Przemek Kitszel <[email protected]>
ice: make use of DEFINE_FLEX() in ice_switch.c

Kefeng Wang <[email protected]>
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Guanghui Yang <[email protected]>
btrfs: zoned: fix missing chunk metadata reservation

Filipe Manana <[email protected]>
btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()

Naohiro Aota <[email protected]>
btrfs: add space_info argument to btrfs_chunk_alloc()

David Sterba <[email protected]>
btrfs: add debug build only WARN

Yuxiang Yang <[email protected]>
tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Ilpo Järvinen <[email protected]>
tcp: fast path functions later

Ilpo Järvinen <[email protected]>
tcp: Pass flags to __tcp_send_ack

Namjae Jeon <[email protected]>
ksmbd: validate minimum PDU size for transform requests

ChenXiaoSong <[email protected]>
smb/server: fix minimum SMB2 PDU size

ChenXiaoSong <[email protected]>
smb/server: fix minimum SMB1 PDU size

Namjae Jeon <[email protected]>
ksmbd: rename smb2_get_msg to smb_get_msg

ChenXiaoSong <[email protected]>
smb/server: rename include guard in smb_common.h

ZhangGuoDong <[email protected]>
smb: move get_rfc1002_len() to common/smbglob.h

ZhangGuoDong <[email protected]>
smb: move smb_version_values to common/smbglob.h

Christian Brauner <[email protected]>
super: fix emergency thaw deadlock on frozen block devices

Aldo Ariel Panzardo <[email protected]>
net/sched: serialize qdisc_rtab_list against concurrent get/put

Shiming Cheng <[email protected]>
net: gro: fix double aggregation of flush-marked skbs

Felix Fietkau <[email protected]>
net: move skb_gro_receive_list from udp to core

Pavitra Jha <[email protected]>
libceph: fix two unsafe bare decodes in decode_lockers()

Mike Rapoport (Microsoft) <[email protected]>
userfaultfd: prevent registration of special VMAs

Mike Rapoport (Microsoft) <[email protected]>
userfaultfd: move vma_can_userfault out of line

Chunyan Zhang <[email protected]>
mm: userfaultfd: add pgtable_supports_uffd_wp()

Zhang Yi <[email protected]>
iomap: fix out-of-bounds bitmap_set() with zero-length range

Matthew Wilcox (Oracle) <[email protected]>
iomap: hold state_lock over call to ifs_set_range_uptodate()

Chancel Liu <[email protected]>
ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP

Xiang Mei <[email protected]>
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Andy Shevchenko <[email protected]>
libceph: Amend checking to fix make W=1 build breakage

Matthew Wilcox (Oracle) <[email protected]>
ceph: Use a folio in ceph_page_mkwrite()

Max Kellermann <[email protected]>
ceph: fix hanging __ceph_get_caps() with stale mds_wanted

Matthew Wilcox (Oracle) <[email protected]>
ceph: Remove ceph_writepage()

Max Kellermann <[email protected]>

    ceph: avoid fs reclaim while using current->journal_info

Sabrina Dubroca <[email protected]>
selftests: tls: add test with a partially invalid iov

Palmer Dabbelt <[email protected]>
RISC-V: Provide pgtable_l5_enabled on rv32

Christoph Hellwig <[email protected]>
xfs: check v5 superblock features early

Long Li <[email protected]>
xfs: don't swallow dquot recovery verification errors

Long Li <[email protected]>
xfs: fix ilock leak on error in xfs_dq_get_next_id

Darrick J. Wong <[email protected]>
xfs: only check mergeability of bnobt records

Junrui Luo <[email protected]>
drm/amdgpu: disallow multiple FENCE chunks in one submit

David Rosca <[email protected]>
drm/amdgpu: Fix UVD decode image min size calculation

David Rosca <[email protected]>
drm/amdgpu: Fix UVD dpb min size calculation for H264

David Rosca <[email protected]>
drm/amdgpu: Fix UVD min buffer sizes

David Rosca <[email protected]>
drm/amdgpu: Implement insert_end for VCE 3

David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with dimensions above 4096

Candice Li <[email protected]>
drm/amdgpu: validate GEM_CREATE domain combinations

David Rosca <[email protected]>
drm/amdgpu: Reject UVD message with invalid number of h265 refs

Eric Farman <[email protected]>
s390/vfio_ccw: Selectively expand io_mutex

Eric Farman <[email protected]>
s390/vfio_ccw: Move cp cleanup out of not operational

Eric Farman <[email protected]>
s390/vfio_ccw: Fix out of bounds check on CCW array

Eric Farman <[email protected]>
s390/vfio_ccw: Ensure index for read/write regions are within range

Eric Farman <[email protected]>
s390/vfio_ccw: Cancel existing workqueues

Eric Farman <[email protected]>
s390/vfio_ccw: Limit the number of channel program segments

Eric Farman <[email protected]>
s390/vfio_ccw: Free all memory if cp_init() fails

Guangshuo Li <[email protected]>
drm/radeon: fix autosuspend cleanup during teardown

Pei Xiao <[email protected]>
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

Haibo Chen <[email protected]>
mmc: sdhci: make tuning_err a signed int

Myeonghun Pak <[email protected]>
mmc: sdhci: unmap the bounce buffer before device release

Zhan Xusheng <[email protected]>
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit

Kefu Chai <[email protected]>
libceph: tolerate addrvecs with multiple entries of the same type

Yiming Zhu <[email protected]>
ceph: fix MDS random selection readiness predicate

Raphael Zimmer <[email protected]>
libceph: Avoid using invalid osd indices from primary_temp

Dmitry Torokhov <[email protected]>
Input: sur40 - fix V4L error path cleanup

Dmitry Torokhov <[email protected]>
Input: sur40 - fix input device registration ordering

Ali Ahmet Memis <[email protected]>
openrisc: signal: do not restore privileged SR bits on sigreturn

Josh Poimboeuf <[email protected]>
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Leon Hwang <[email protected]>
ftrace: Protect direct_functions in ftrace_find_rec_direct

Pavitra Jha <[email protected]>
libceph: fix multiple unsafe decodes in decode_locker()

Thorsten Blum <[email protected]>
crypto: qce - fix error path in devm_qce_register_algs

Jianing Li <[email protected]>
Input: hynitron_cstxxx - validate touch count and finger IDs

Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - block s_input when F54 queue is busy

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - zero report size on F54 work error

George Wilson <[email protected]>

    powerpc/pseries: lparcfg - fix kbuf[] underflow

Pengpeng Hou <[email protected]>
Input: iforce - validate input packet lengths

Zhefu Zhang <[email protected]>
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Linmao Li <[email protected]>
Input: psxpad-spi - set driver data before use

Richard Davies <[email protected]>
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

George Wilson <[email protected]>
powerpc/pseries: pci - logic bug

Kyohei Kadota <[email protected]>
Input: xpad - add support for ZENAIM LEVERLESS

Asad Kamal <[email protected]>
drm/amdgpu: fix aperture iounmap skipped on device removal

Mingyu Wang <[email protected]>
fbdev: core: Fix pointer desynchronization in fb_io_read()

Dawid Wróbel <[email protected]>
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

Peter Ujfalusi <[email protected]>
ASoC: cs35l41: sort the register default table

Peter Ujfalusi <[email protected]>
ASoC: cs35l45: sort the register default table

Peter Ujfalusi <[email protected]>
ASoC: cs4265: sort the register default table

Peter Ujfalusi <[email protected]>
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()

Hidayath Khan <[email protected]>
s390/qeth: validate user buffer length in SNMP and ARP query ioctls

Wyatt Feng <[email protected]>
mptcp: fastopen: only mark MPTFO subflows with SYN data

Matthieu Baerts (NGI0) <[email protected]>
mptcp: options: reset DSS fields in case of unexpected size

Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid combining some incoming suboptions

Gang Yan <[email protected]>
selftests: mptcp: join: mark tests with data corruption as failed

Bryam Vargas <[email protected]>
selinux: reject an unclaimed class value in security_get_classes()

Bryam Vargas <[email protected]>
selinux: do not cancel a policy conversion that never started

Bryam Vargas <[email protected]>
selinux: reject a class permission count below its inherited common

Bryam Vargas <[email protected]>
selinux: require every boolean value to be defined

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix EQ leak in mana_remove on NULL port

Yizhou Zhao <[email protected]>
ipvs: separate destination availability state

Chao Yu <[email protected]>
f2fs: fix UAF issue in f2fs_merge_page_bio()

Chao Shi <[email protected]>
block: stop the timeout timer when releasing a never added disk

-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/Kconfig                                   |   1 +
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   2 +
 arch/m68k/Kconfig                                  |   7 +-
 arch/m68k/Kconfig.cpu                              |  16 +
 arch/m68k/kernel/Makefile                          |   2 +-
 arch/m68k/kernel/dma.c                             |   2 +-
 arch/openrisc/include/asm/processor.h              |   2 +
 arch/openrisc/kernel/dma.c                         |   4 +-
 arch/openrisc/kernel/signal.c                      |   5 +-
 arch/parisc/Kconfig                                |   1 +
 arch/powerpc/platforms/pseries/lparcfg.c           |   2 +-
 arch/powerpc/platforms/pseries/pci.c               |   2 +-
 arch/riscv/include/asm/pgtable-32.h                |   3 +
 arch/riscv/include/asm/pgtable.h                   |   1 -
 arch/riscv/mm/init.c                               |   2 +
 arch/riscv/mm/pageattr.c                           |   8 +-
 arch/x86/kvm/svm/sev.c                             |  34 +-
 arch/x86/kvm/svm/svm.h                             |   1 +
 block/genhd.c                                      |  12 +-
 crypto/ccm.c                                       |   2 +-
 drivers/crypto/qce/core.c                          |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  34 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |  21 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |  85 +---
 drivers/gpu/drm/amd/amdgpu/vce_v3_0.c              |  26 +-
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c                |  27 +-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |  16 +-
 drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h            |   6 +-
 drivers/gpu/drm/radeon/radeon_kms.c                |   1 +
 drivers/i2c/busses/i2c-bcm-iproc.c                 |  11 +-
 drivers/input/joystick/iforce/iforce-packets.c     |  11 +-
 drivers/input/joystick/iforce/iforce-usb.c         |   3 +
 drivers/input/joystick/psxpad-spi.c                |   1 +
 drivers/input/joystick/xpad.c                      |   2 +
 drivers/input/keyboard/atkbd.c                     |   8 +
 drivers/input/mouse/focaltech.c                    |   2 +-
 drivers/input/rmi4/rmi_f54.c                       |  43 +-
 drivers/input/rmi4/rmi_f55.c                       |   4 +-
 drivers/input/touchscreen/hynitron_cstxxx.c        |  13 +-
 drivers/input/touchscreen/sur40.c                  |  23 +-
 drivers/mmc/host/atmel-mci.c                       |   2 +
 drivers/mmc/host/omap_hsmmc.c                      |   2 +-
 drivers/mmc/host/sdhci.c                           |  16 +
 drivers/mmc/host/sdhci.h                           |   2 +-
 drivers/net/can/rcar/rcar_canfd.c                  |  28 +-
 drivers/net/ethernet/intel/ice/ice_base.c          |  58 ++-
 drivers/net/ethernet/intel/ice/ice_base.h          |   3 +-
 drivers/net/ethernet/intel/ice/ice_lib.c           |  56 ---
 drivers/net/ethernet/intel/ice/ice_lib.h           |   4 -
 drivers/net/ethernet/intel/ice/ice_switch.c        |  63 +--
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |  27 +
 .../net/ethernet/intel/ice/ice_vf_lib_private.h    |   1 +
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |  21 +
 drivers/net/ethernet/intel/ice/ice_xsk.c           |   2 +-
 drivers/net/ethernet/intel/igc/igc_main.c          |   1 -
 drivers/net/ethernet/microsoft/mana/mana_en.c      |   4 +-
 drivers/net/ethernet/ti/am65-cpsw-nuss.c           |   2 +
 drivers/net/ipvlan/ipvlan_main.c                   |   4 +
 drivers/net/macvlan.c                              |   4 +
 drivers/net/veth.c                                 |   4 +-
 drivers/net/vrf.c                                  |  49 +-
 drivers/net/vxlan/vxlan_core.c                     |  45 +-
 drivers/net/vxlan/vxlan_mdb.c                      |   4 +-
 drivers/s390/cio/vfio_ccw_async.c                  |  16 +
 drivers/s390/cio/vfio_ccw_chp.c                    |  17 +-
 drivers/s390/cio/vfio_ccw_cp.c                     |  53 +-
 drivers/s390/cio/vfio_ccw_cp.h                     |   8 +
 drivers/s390/cio/vfio_ccw_drv.c                    |  15 +-
 drivers/s390/cio/vfio_ccw_fsm.c                    |   8 +-
 drivers/s390/cio/vfio_ccw_ops.c                    |  35 +-
 drivers/s390/cio/vfio_ccw_private.h                |   6 +-
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/net/qeth_l3_main.c                    |   5 +
 drivers/video/fbdev/core/fb_io_fops.c              |   8 +
 fs/binfmt_elf.c                                    |   4 +-
 fs/binfmt_elf_fdpic.c                              |   4 +-
 fs/binfmt_misc.c                                   |  14 +-
 fs/btrfs/block-group.c                             |  61 ++-
 fs/btrfs/block-group.h                             |   3 +-
 fs/btrfs/extent-tree.c                             |   6 +-
 fs/btrfs/messages.h                                |   7 +
 fs/btrfs/space-info.c                              |   2 +-
 fs/btrfs/transaction.c                             |   5 +-
 fs/btrfs/zoned.c                                   |   5 +-
 fs/btrfs/zoned.h                                   |   6 +-
 fs/ceph/addr.c                                     |  54 +-
 fs/ceph/caps.c                                     |  17 +-
 fs/ceph/file.c                                     |   9 +-
 fs/ceph/mds_client.c                               |  11 +
 fs/ceph/mds_client.h                               |   2 +
 fs/ceph/mdsmap.c                                   |   2 +-
 fs/erofs/Kconfig                                   |   3 +-
 fs/exec.c                                          |   6 +-
 fs/f2fs/data.c                                     |   2 +-
 fs/iomap/buffered-io.c                             |  42 +-
 fs/smb/client/cifsglob.h                           |  27 -
 fs/smb/client/cifssmb.c                            |   6 +-
 fs/smb/client/connect.c                            |   2 +-
 fs/smb/client/transport.c                          |   8 +-
 fs/smb/common/cifsglob.h                           |  36 ++
 fs/smb/server/auth.c                               |   4 +-
 fs/smb/server/connection.c                         |  23 +-
 fs/smb/server/connection.h                         |   5 +
 fs/smb/server/oplock.c                             |   8 +-
 fs/smb/server/smb2misc.c                           |   2 +-
 fs/smb/server/smb2ops.c                            |  32 +-
 fs/smb/server/smb2pdu.c                            |  88 ++--
 fs/smb/server/smb2pdu.h                            |   9 -
 fs/smb/server/smb_common.c                         |  43 +-
 fs/smb/server/smb_common.h                         |  43 +-
 fs/super.c                                         |  22 +-
 fs/userfaultfd.c                                   |  20 +-
 fs/xfs/libxfs/xfs_sb.c                             |   4 +-
 fs/xfs/scrub/alloc.c                               |   5 +-
 fs/xfs/xfs_dquot.c                                 |   3 +-
 fs/xfs/xfs_dquot_item_recover.c                    |   2 +-
 include/asm-generic/pgtable_uffd.h                 |  17 +
 include/linux/fs.h                                 |  12 +
 include/linux/mm_inline.h                          |   7 +-
 include/linux/mmap_lock.h                          |   4 +
 include/linux/netdevice.h                          |  52 +-
 include/linux/overflow.h                           |  52 ++
 include/linux/pagewalk.h                           |   7 +-
 include/linux/userfaultfd_k.h                      |  19 +-
 include/net/bluetooth/hci.h                        |   8 +-
 include/net/bluetooth/hci_core.h                   |   1 +
 include/net/dropreason-core.h                      |  21 +
 include/net/gro.h                                  |   1 +
 include/net/ip_vs.h                                |   7 +
 include/net/pkt_cls.h                              |  16 +
 include/net/pkt_sched.h                            |   3 +-
 include/net/sch_generic.h                          |   2 -
 include/net/tcp.h                                  |  58 +--
 include/uapi/linux/ip_vs.h                         |   6 -
 kernel/dma/Kconfig                                 |   9 +
 kernel/dma/direct.c                                |  12 +-
 kernel/fork.c                                      |  12 +-
 kernel/trace/ftrace.c                              |   9 +-
 lib/overflow_kunit.c                               |  19 +
 mm/huge_memory.c                                   |  49 +-
 mm/internal.h                                      |   7 +
 mm/migrate_device.c                                |   5 +-
 mm/pagewalk.c                                      |  82 ++-
 mm/ptdump.c                                        |  10 +-
 mm/userfaultfd.c                                   |  26 +
 mm/vmalloc.c                                       |  49 +-
 net/bluetooth/eir.c                                |   7 +-
 net/bluetooth/eir.h                                |   2 +-
 net/bluetooth/hci_core.c                           |   9 +
 net/bluetooth/hci_event.c                          |   3 +-
 net/bluetooth/hci_sync.c                           | 237 +++++----
 net/ceph/cls_lock_client.c                         |  21 +-
 net/ceph/decode.c                                  |  18 +-
 net/ceph/osdmap.c                                  |   9 +-
 net/core/dev.c                                     |  29 +-
 net/core/gro.c                                     |  31 ++
 net/core/pktgen.c                                  |  43 +-
 net/ipv4/bpf_tcp_ca.c                              |   2 +-
 net/ipv4/tcp_dctcp.h                               |   2 +-
 net/ipv4/tcp_input.c                               |  56 ++-
 net/ipv4/tcp_minisocks.c                           |  12 +-
 net/ipv4/tcp_output.c                              |   6 +-
 net/ipv4/udp_offload.c                             |  29 --
 net/mptcp/fastopen.c                               |   7 +-
 net/mptcp/options.c                                |  67 ++-
 net/mptcp/protocol.h                               |   1 +
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   2 +-
 net/netfilter/ipset/ip_set_core.c                  |  19 +-
 net/netfilter/ipset/ip_set_list_set.c              |  10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   6 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_dh.c                      |   4 +-
 net/netfilter/ipvs/ip_vs_lblc.c                    |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   8 +-
 net/netfilter/nf_flow_table_core.c                 |   7 +-
 net/netfilter/nf_tables_offload.c                  |   2 +-
 net/packet/af_packet.c                             |  27 +-
 net/sched/act_api.c                                |  13 +-
 net/sched/cls_api.c                                |  32 +-
 net/sched/cls_bpf.c                                |  18 +-
 net/sched/cls_u32.c                                |   3 +
 net/sched/sch_api.c                                |  24 +-
 net/tls/tls_sw.c                                   |   7 +
 net/x25/af_x25.c                                   |   4 +-
 net/x25/x25_timer.c                                |  25 +-
 security/selinux/ss/policydb.c                     |  31 ++
 security/selinux/ss/services.c                     |  28 +-
 sound/soc/codecs/cs35l41-lib.c                     |   2 +-
 sound/soc/codecs/cs35l45-tables.c                  |  32 +-
 sound/soc/codecs/cs4265.c                          |   4 +-
 sound/soc/codecs/lpass-wsa-macro.c                 |   8 +-
 sound/soc/codecs/tas2562.c                         |   9 +-
 sound/soc/fsl/fsl_sai.c                            |  29 +-
 sound/soc/sof/sof-audio.c                          |   9 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |  10 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +-
 tools/testing/selftests/net/tls.c                  | 549 +++++++++++++++++++++
 200 files changed, 2659 insertions(+), 1145 deletions(-)

Read the cover letter in its thread