Skip to content

7.1.11-rc1 review

Greg Kroah-Hartman amd-gfx imx linux-patches lkml loongarch stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest101 patches 13 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/101xfs: hoist per-bucket unlinked list check to helperfs/xfs/scrub/agheader.c+41 -210 replies
2/101xfs: dont livelock in scrub on a circular unlinked listfs/xfs/scrub/agheader.c fs/xfs/scrub/agheader_repair.c+51 -100 replies
3/101xfs: add a xchk_ip_set_corrupt helperfs/xfs/scrub/bmap.c fs/xfs/scrub/common.c fs/xfs/scrub/common.h +7 more+38 -360 replies
4/101xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref errorfs/xfs/scrub/rtsummary.c+1 -10 replies
5/101PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsdrivers/pci/controller/pci-host-generic.c drivers/pci/ecam.c include/linux/pci-ecam.h+17 -100 replies
6/101Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup acceptnet/bluetooth/rfcomm/core.c+21 -30 replies
7/101iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardowndrivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c+16 -20 replies
8/101iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pagesdrivers/iommu/iommufd/ioas.c+4 -00 replies
9/101ALSA: FCP: Use a private URB for the notification endpointsound/usb/fcp.c+21 -170 replies
10/101ALSA: scarlett2: Use a private URB for the notification endpointsound/usb/mixer.c sound/usb/mixer.h sound/usb/mixer_scarlett2.c+71 -350 replies
11/101rndis_host: add overflow check in rndis_rx_fixup()drivers/net/usb/rndis_host.c+5 -10 replies
12/101nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()drivers/nvme/target/admin-cmd.c+1 -10 replies
13/101io_uring/futex: dont mark futex wake requests as inflightio_uring/futex.c io_uring/futex.h io_uring/opdef.c+13 -10 replies
14/101io_uring/futex: only mark private futex waits as inflightio_uring/futex.c+13 -40 replies
15/101ALSA: dummy: Check card index validity at probesound/drivers/dummy.c+6 -00 replies
16/101io_uring/cmd: fix iovec leak when the async cmd is not recycledio_uring/uring_cmd.c+4 -00 replies
17/101io_uring/io-wq: fix worker accounting when canceling creation callbacksio_uring/io-wq.c+6 -30 replies
18/101io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()io_uring/rsrc.c+1 -10 replies
19/101io_uring/uring_cmd: dont skip completion for a synchronous multishot cmdio_uring/uring_cmd.c+0 -40 replies
20/101io_uring: defer eventfd signaling when queued from a wakeup handlerinclude/linux/io_uring_types.h io_uring/eventfd.c io_uring/eventfd.h +5 more+30 -210 replies
21/101ocfs2: fix missing metadata reservation for large xattrsfs/ocfs2/xattr.c+12 -60 replies
22/101null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflowsdrivers/block/null_blk/zoned.c+8 -20 replies
23/101kcov: fix data corruption and race conditions on PREEMPT_RTinclude/linux/sched.h kernel/kcov.c lib/Kconfig.debug+58 -450 replies
24/101ext4: stop retrying saturated xattr cache entriesfs/ext4/xattr.c+4 -20 replies
25/101nilfs2: reject invalid block index in GC ioctlfs/nilfs2/ioctl.c+18 -20 replies
26/101ext4: clear error before retrying inode xattr space fallbackfs/ext4/xattr.c+1 -00 replies
27/101ext4: avoid tail write_begin walk for uptodate foliosfs/ext4/inode.c+6 -50 replies
28/101ext4: propagate errors from fast commit range replayfs/ext4/fast_commit.c+12 -40 replies
29/101ext4: dont enable DAX on new encrypted filesfs/ext4/crypto.c fs/ext4/ialloc.c+24 -200 replies
30/101ext4: fix incorrect function call when initializing s_resgidfs/ext4/super.c+1 -10 replies
31/101xfs: validate attr entry pointer before field accessfs/xfs/libxfs/xfs_attr_leaf.c+14 -00 replies
32/101xfs: restore nofs context unconditionally in xfs_trans_rollfs/xfs/xfs_trans.c+9 -70 replies
33/101drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usagedrivers/gpu/drm/i915/display/intel_fb_pin.c+11 -130 replies
34/101drm/i915: Track fence region ID in plane statedrivers/gpu/drm/i915/display/intel_display_types.h drivers/gpu/drm/i915/display/intel_fb_pin.c drivers/gpu/drm/i915/display/intel_fb_pin.h +6 more+37 -410 replies
35/101drm/i915: Introduce struct intel_fb_pin_paramsdrivers/gpu/drm/i915/display/intel_fb_pin.c drivers/gpu/drm/i915/display/intel_fb_pin.h drivers/gpu/drm/i915/display/intel_fbdev.c +2 more+69 -550 replies
36/101drm/xe: Fix DPT allocation paths.drivers/gpu/drm/xe/display/xe_fb_pin.c+8 -250 replies
37/101nfc: digital: clamp SENSF_RES length to the destination buffernet/nfc/digital_technology.c+2 -00 replies
38/101nfc: fdp: bound the device-reported read length and fix an skb leakdrivers/nfc/fdp/i2c.c+27 -00 replies
39/101nfc: microread: validate target discovery payload lengthsdrivers/nfc/microread/microread.c+29 -20 replies
40/101nfc: llcp: bound the connect_sn TLV walk to the skbnet/nfc/llcp_core.c+6 -40 replies
41/101nfc: llcp: fix OOB read and u8 offset wrap in TLV parsersnet/nfc/llcp_commands.c+16 -20 replies
42/101nfc: llcp: reject PDUs shorter than the LLCP headernet/nfc/llcp_core.c+5 -00 replies
43/101nfc: pn533: purge fragmented skbs during cleanupdrivers/nfc/pn533/pn533.c+1 -00 replies
44/101nfc: st21nfca: validate ATR_REQ length against the received framedrivers/nfc/st21nfca/dep.c+3 -00 replies
45/101nfc: nci: add data_len bound checks to activation parameter extractorsnet/nfc/nci/ntf.c+22 -40 replies
46/101nfc: nci: fix out-of-bounds write in nci_target_auto_activated()net/nfc/nci/ntf.c+6 -00 replies
47/101nfc: nci: fix uninit-value in the RF discover/activated NTF handlersnet/nfc/nci/ntf.c+2 -20 replies
48/101nfc: nci: free destination parameters when closing a connectionnet/nfc/nci/rsp.c+1 -00 replies
49/101ipv4: reject undersized MTUs in ip_do_fragment()net/ipv4/ip_output.c+4 -00 replies
50/101ipv6: fix use-after-free in ip6_finish_output2()net/ipv6/ip6_output.c+2 -00 replies
51/101mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()drivers/mailbox/mailbox-mchp-ipc-sbi.c+2 -00 replies
52/101dmaengine: fsl-edma: Add error handling for devm_kasprintfdrivers/dma/fsl-edma-main.c+2 -00 replies
53/101nvmet-auth: zero the AUTH_RECEIVE response bufferdrivers/nvme/target/fabrics-cmd-auth.c+1 -10 replies
54/101nvmet-fc: fix invalid free in LS IOD error pathdrivers/nvme/target/fc.c+1 -10 replies
55/101nvmet-tcp: bound SGL data length before allocating command buffersdrivers/nvme/target/tcp.c+13 -00 replies
56/101nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocationsdrivers/nvme/target/tcp.c+4 -20 replies
57/101nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()drivers/nvme/target/pci-epf.c+6 -30 replies
58/101nvmet: pci-epf: put CQ ref on create_cq mapping failuredrivers/nvme/target/pci-epf.c+1 -00 replies
59/101fbdev: Wrap user-invoked calls to fb_set_var() in helperdrivers/video/fbdev/core/fb_chrdev.c drivers/video/fbdev/core/fbcon.c drivers/video/fbdev/core/fbmem.c +4 more+19 -180 replies
60/101fbdev: serialize mode sysfs access with lock_fb_info()drivers/video/fbdev/core/fbsysfs.c+38 -80 replies
61/101drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_formatdrivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h+184 -1240 replies
62/101drm/amdgpu: Allocate coredump ring buffers per ringdrivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h+27 -260 replies
63/101mptcp: pm: rename add_entry structure to add_addrnet/mptcp/pm.c net/mptcp/protocol.h+12 -120 replies
64/101mptcp: pm: uniform announced addresses helpersnet/mptcp/options.c net/mptcp/pm.c net/mptcp/pm_kernel.c +3 more+33 -340 replies
65/101mptcp: pm: fix memory leak from alloc-during-teardown racenet/mptcp/pm.c net/mptcp/pm_userspace.c net/mptcp/protocol.h+19 -50 replies
66/101selinux: use u16 for security classessecurity/selinux/ss/policydb.c security/selinux/ss/policydb.h security/selinux/ss/services.c+9 -80 replies
67/101selinux: more strict policy parsingsecurity/selinux/include/security.h security/selinux/ss/avtab.c security/selinux/ss/avtab.h +5 more+233 -600 replies
68/101selinux: require a classs permission values to cover its permission countsecurity/selinux/ss/policydb.c+46 -50 replies
69/101HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-Cdrivers/hid/hid-input.c drivers/hid/hid-magicmouse.c+21 -10 replies
70/101HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()drivers/hid/hid-magicmouse.c+20 -50 replies
71/101HID: magicmouse: re-enable multitouch after reset-resumedrivers/hid/hid-magicmouse.c+19 -00 replies
72/101HID: magicmouse: do not keep a stale msc->input if no input is claimeddrivers/hid/hid-magicmouse.c+10 -00 replies
73/101HID: core: fix OOB read of field->usage in hid_set_field()drivers/hid/hid-core.c+3 -20 replies
74/101HID: pidff: fix OOB write when hid->inputs is emptydrivers/hid/usbhid/hid-pidff.c+10 -30 replies
75/101net/ionic: avoid OOB TX partner lookup for hwstamp RXQdrivers/net/ethernet/pensando/ionic/ionic_lif.c drivers/net/ethernet/pensando/ionic/ionic_txrx.c+21 -30 replies
76/101futex/pi: Reject cross-mm private futex ownerskernel/futex/core.c kernel/futex/futex.h kernel/futex/pi.c+29 -90 replies
77/101futex: Sanitize and document task_struct::futex::state transitionskernel/futex/core.c kernel/futex/pi.c+73 -400 replies
78/101futex/pi: Plug private futex exec() racefs/exec.c include/linux/futex.h kernel/futex/core.c +1 more+61 -250 replies
79/101futex: Fix race in futex_pivot_pending() during private hash resizekernel/futex/core.c+2 -20 replies
80/101futex: Fix race on the initial mm->futex.phash.ref allocationkernel/futex/core.c+10 -60 replies
81/101futex: Fix might_sleep() warning in futex_pivot_pending()include/linux/wait.h include/linux/wait_bit.h kernel/futex/core.c +2 more+54 -40 replies
82/101HID: asus: fix missing hid_is_usb() checkdrivers/hid/hid-asus.c+1 -10 replies
83/101HID: huawei: fix missing hid_is_usb() checkdrivers/hid/hid-huawei.c+3 -20 replies
84/101HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()drivers/hid/hid-nintendo.c+6 -10 replies
85/101HID: nintendo: register input device after capabilities are setdrivers/hid/hid-nintendo.c+4 -40 replies
86/101HID: nintendo: stop device IO before hid_hw_stop on probe failuredrivers/hid/hid-nintendo.c+4 -30 replies
87/101HID: rapoo: fix missing hid_is_usb() checkdrivers/hid/Kconfig drivers/hid/hid-rapoo.c+2 -10 replies
88/101HID: core: fix number/pointer type confusion on long itemsdrivers/hid/hid-core.c+6 -00 replies
89/101HID: ft260: fix stack-use-after-return write in I2C read racedrivers/hid/hid-ft260.c+24 -10 replies
90/101HID: sensor: custom: Fix use-after-free in enable_sensordrivers/hid/hid-sensor-custom.c+9 -80 replies
91/101HID: uclogic: fix use-after-free of inrange_timer on removedrivers/hid/hid-uclogic-core.c+11 -10 replies
92/101HID: hyperv: validate initial device info boundsdrivers/hid/hid-hyperv.c+24 -30 replies
93/101HID: input: read battery capacity from its actual report offsetdrivers/hid/hid-input.c include/linux/hid.h+15 -40 replies
94/101drm/xe: Dont hand out the flat CCS storage as usable VRAMdrivers/gpu/drm/xe/xe_vram.c+18 -50 replies
95/101Bluetooth: hci_event: fix LE list UAF on resetnet/bluetooth/hci_event.c+2 -00 replies
96/101Bluetooth: hci_event: validate LE Set CIG Parameters responsenet/bluetooth/hci_event.c+4 -20 replies
97/101Bluetooth: hci_sync: Fix accept list UAF during suspendnet/bluetooth/hci_sync.c+39 -110 replies
98/101Bluetooth: ISO: do not force BT_LISTEN after a failed BIG syncnet/bluetooth/iso.c+22 -80 replies
99/101Bluetooth: ISO: zero the sockaddr before returning it in getnamenet/bluetooth/iso.c+2 -00 replies
100/101Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255net/bluetooth/mgmt.c+8 -00 replies
101/101Bluetooth: hci_aml: validate firmware segment lengthsdrivers/bluetooth/hci_aml.c+16 -20 replies

Reviews trailers per patch

56 of 101 patches have a Reviewed-by or Acked-by.

PatchChristoph HellwigCarlos MaiolinoDarrick J. WongGabriel Krisman BertaziJoseph QiDamien Le MoalAlexander Potapenko[email protected]Jan KaraDisha GoelOjaswin MujooRitesh Harjani (IBM)Ville SyrjäläNicolin ChenJason GunthorpeJani NikulaMatthew AuldMatthew BrostAlexander LobakinSimon HormanVadim FedorenkoHannes ReineckeNilay ShroffChristian KönigAlex DeucherMat MartineauMatthieu Baerts (NGI0)Stephen SmalleyAlec HallSi-Wei LiuShannon NelsonBrett CreeleyPeter ZijlstraKyle ZengSilvan JegenIdo SchimmelFrank LiMaurizio LombardiMichael ZaidmanSrinivas PandruvadaPavel Machek (CIP)Justin M. ForbesFlorian FainelliShuah KhanRon EconomosBrett A C SheffieldTakeshi OgasawaraMiguel OjedaPeter SchneiderBenjamin BoortzBarry K. NathanMark BrownDileep Malepu
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/101R-b
2/101R-b
3/101R-b R-b
4/101R-b
5/101
6/101
7/101R-b R-b
8/101
9/101
10/101
11/101R-b
12/101R-b R-b R-b
13/101
14/101
15/101
16/101
17/101R-b
18/101
19/101
20/101
21/101R-b
22/101R-b
23/101R-b
24/101Reported-and-tested-by T-b R-b
25/101
26/101R-b
27/101R-b
28/101R-b
29/101R-b T-b R-b
30/101R-b
31/101R-b
32/101R-b R-b
33/101R-b
34/101R-b
35/101R-b
36/101R-b A-b
37/101R-b
38/101
39/101
40/101R-b
41/101R-b
42/101R-b
43/101
44/101R-b
45/101
46/101R-b
47/101
48/101R-b
49/101R-b
50/101R-b R-b
51/101
52/101R-b
53/101R-b
54/101R-b
55/101R-b
56/101
57/101R-b R-b
58/101R-b
59/101
60/101
61/101R-b
62/101R-b
63/101R-b
64/101R-b
65/101R-b
66/101A-b
67/101A-b
68/101A-b
69/101
70/101R-b T-b
71/101
72/101R-b T-b
73/101
74/101
75/101R-b R-b R-b R-b
76/101A-b
77/101A-b R-b
78/101A-b R-b
79/101
80/101
81/101
82/101
83/101
84/101R-b
85/101
86/101
87/101
88/101
89/101R-b
90/101A-b
91/101
92/101
93/101R-b
94/101
95/101
96/101
97/101
98/101
99/101
100/101
101/101

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 53 reviewers.

Read the v1 thread

Cover letter [PATCH 7.1 000/101] 7.1.11-rc1 review

This is the start of the stable review cycle for the 7.1.11 release. There are 101 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.11-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 7.1.11-rc1

Laxman Acharya Padhya <[email protected]>
Bluetooth: hci_aml: validate firmware segment lengths

Ali Ahmet Memis <[email protected]>
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

Ali Ahmet Memis <[email protected]>
Bluetooth: ISO: zero the sockaddr before returning it in getname

Ali Ahmet Memis <[email protected]>
Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix accept list UAF during suspend

Laxman Acharya Padhya <[email protected]>
Bluetooth: hci_event: validate LE Set CIG Parameters response

Chengfeng Ye <[email protected]>
Bluetooth: hci_event: fix LE list UAF on reset

Linus Torvalds <[email protected]>
drm/xe: Don't hand out the flat CCS storage as usable VRAM

Jose Villaseñor Montfort <[email protected]>
HID: input: read battery capacity from its actual report offset

Michael Bommarito <[email protected]>
HID: hyperv: validate initial device info bounds

Ibrahim Hashimov <[email protected]>
HID: uclogic: fix use-after-free of inrange_timer on remove

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix use-after-free in enable_sensor

Raman Varabets <[email protected]>
HID: ft260: fix stack-use-after-return write in I2C read race

Jann Horn <[email protected]>
HID: core: fix number/pointer type confusion on long items

Jann Horn <[email protected]>
HID: rapoo: fix missing hid_is_usb() check

Jiangshan Yi <[email protected]>
HID: nintendo: stop device IO before hid_hw_stop on probe failure

Jiangshan Yi <[email protected]>
HID: nintendo: register input device after capabilities are set

Ibrahim Hashimov <[email protected]>
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

Jann Horn <[email protected]>
HID: huawei: fix missing hid_is_usb() check

Jann Horn <[email protected]>
HID: asus: fix missing hid_is_usb() check

Peter Zijlstra <[email protected]>
futex: Fix might_sleep() warning in futex_pivot_pending()

Hyunwoo Kim <[email protected]>

    futex: Fix race on the initial mm->futex.phash.ref allocation

Yao Kai <[email protected]>
futex: Fix race in futex_pivot_pending() during private hash resize

Thomas Gleixner <[email protected]>
futex/pi: Plug private futex exec() race

Thomas Gleixner <[email protected]>
futex: Sanitize and document task_struct::futex::state transitions

Kyle Zeng <[email protected]>
futex/pi: Reject cross-mm private futex owners

Anand Khoje <[email protected]>
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

Baul Lee <[email protected]>

    HID: pidff: fix OOB write when hid->inputs is empty

Baul Lee <[email protected]>

    HID: core: fix OOB read of field->usage in hid_set_field()

Jose Villaseñor Montfort <[email protected]>

    HID: magicmouse: do not keep a stale msc->input if no input is claimed

Christopher Kodama <[email protected]>
HID: magicmouse: re-enable multitouch after reset-resume

Jose Villaseñor Montfort <[email protected]>
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

Andrei Fed <[email protected]>
HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C

Bryam Vargas <[email protected]>
selinux: require a class's permission values to cover its permission count

Christian Göttsche <[email protected]>
selinux: more strict policy parsing

Christian Göttsche <[email protected]>
selinux: use u16 for security classes

Shardul Bankar <[email protected]>
mptcp: pm: fix memory leak from alloc-during-teardown race

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: uniform announced addresses helpers

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: rename add_entry structure to add_addr

Lijo Lazar <[email protected]>
drm/amdgpu: Allocate coredump ring buffers per ring

Mikhail Gavrilov <[email protected]>
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format

Melbin K Mathew <[email protected]>
fbdev: serialize mode sysfs access with lock_fb_info()

Thomas Zimmermann <[email protected]>
fbdev: Wrap user-invoked calls to fb_set_var() in helper

Yifei Gao <[email protected]>
nvmet: pci-epf: put CQ ref on create_cq mapping failure

Shin'ichiro Kawasaki <[email protected]>
nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()

Greg Kroah-Hartman <[email protected]>
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

Ibrahim Hashimov <[email protected]>
nvmet-tcp: bound SGL data length before allocating command buffers

Jiang HongHui <[email protected]>
nvmet-fc: fix invalid free in LS IOD error path

Bryam Vargas <[email protected]>
nvmet-auth: zero the AUTH_RECEIVE response buffer

Griffin Kroah-Hartman <[email protected]>
dmaengine: fsl-edma: Add error handling for devm_kasprintf

Griffin Kroah-Hartman <[email protected]>
mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()

Luxiao Xu <[email protected]>
ipv6: fix use-after-free in ip6_finish_output2()

Yong Wang <[email protected]>
ipv4: reject undersized MTUs in ip_do_fragment()

Linmao Li <[email protected]>
nfc: nci: free destination parameters when closing a connection

Samuel Page <[email protected]>
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

Samuel Page <[email protected]>
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()

Bryam Vargas <[email protected]>
nfc: nci: add data_len bound checks to activation parameter extractors

Doruk Tan Ozturk <[email protected]>
nfc: st21nfca: validate ATR_REQ length against the received frame

Xu Rao <[email protected]>
nfc: pn533: purge fragmented skbs during cleanup

Doruk Tan Ozturk <[email protected]>
nfc: llcp: reject PDUs shorter than the LLCP header

Muhammad Bilal <[email protected]>
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

Doruk Tan Ozturk <[email protected]>
nfc: llcp: bound the connect_sn TLV walk to the skb

Pengpeng Hou <[email protected]>
nfc: microread: validate target discovery payload lengths

Bryam Vargas <[email protected]>
nfc: fdp: bound the device-reported read length and fix an skb leak

Doruk Tan Ozturk <[email protected]>
nfc: digital: clamp SENSF_RES length to the destination buffer

Maarten Lankhorst <[email protected]>
drm/xe: Fix DPT allocation paths.

Ville Syrjälä <[email protected]>
drm/i915: Introduce struct intel_fb_pin_params

Ville Syrjälä <[email protected]>
drm/i915: Track fence region ID in plane state

Jani Nikula <[email protected]>
drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usage

Yun Zhou <[email protected]>
xfs: restore nofs context unconditionally in xfs_trans_roll

Hongling Zeng <[email protected]>
xfs: validate attr entry pointer before field access

Jiazi Liu <[email protected]>
ext4: fix incorrect function call when initializing s_resgid

Eric Biggers <[email protected]>
ext4: don't enable DAX on new encrypted files

Guanghui Yang <[email protected]>
ext4: propagate errors from fast commit range replay

Jia Zhu <[email protected]>
ext4: avoid tail write_begin walk for uptodate folios

Guanghui Yang <[email protected]>
ext4: clear error before retrying inode xattr space fallback

Ryusuke Konishi <[email protected]>
nilfs2: reject invalid block index in GC ioctl

Matthias Goergens <[email protected]>
ext4: stop retrying saturated xattr cache entries

Tetsuo Handa <[email protected]>
kcov: fix data corruption and race conditions on PREEMPT_RT

Rik van Riel <[email protected]>
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows

Ian Bridges <[email protected]>
ocfs2: fix missing metadata reservation for large xattrs

Jens Axboe <[email protected]>
io_uring: defer eventfd signaling when queued from a wakeup handler

Jens Axboe <[email protected]>
io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd

Ali Ahmet Memis <[email protected]>
io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

Vishnu Razdan <[email protected]>
io_uring/io-wq: fix worker accounting when canceling creation callbacks

Woraphat Khiaodaeng <[email protected]>
io_uring/cmd: fix iovec leak when the async cmd is not recycled

Takashi Iwai <[email protected]>
ALSA: dummy: Check card index validity at probe

Jens Axboe <[email protected]>
io_uring/futex: only mark private futex waits as inflight

Jens Axboe <[email protected]>
io_uring/futex: don't mark futex wake requests as inflight

Guixin Liu <[email protected]>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

Griffin Kroah-Hartman <[email protected]>
rndis_host: add overflow check in rndis_rx_fixup()

Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Use a private URB for the notification endpoint

Geoffrey D. Bennett <[email protected]>
ALSA: FCP: Use a private URB for the notification endpoint

Peiyang He <[email protected]>
iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages

Shameer Kolothum <[email protected]>
iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

Ali Ahmet Memis <[email protected]>
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

Steffen Persvold <[email protected]>
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

Darrick J. Wong <[email protected]>
xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error

Christoph Hellwig <[email protected]>
xfs: add a xchk_ip_set_corrupt helper

Darrick J. Wong <[email protected]>
xfs: don't livelock in scrub on a circular unlinked list

Darrick J. Wong <[email protected]>
xfs: hoist per-bucket unlinked list check to helper

-------------

Diffstat:

 Makefile                                           |   4 +-
 drivers/block/null_blk/zoned.c                     |  10 +-
 drivers/bluetooth/hci_aml.c                        |  18 +-
 drivers/dma/fsl-edma-main.c                        |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c   | 265 ++++++++++++---------
 drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h   |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |  91 ++++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h             |   2 +-
 drivers/gpu/drm/i915/display/intel_display_types.h |   5 +-
 drivers/gpu/drm/i915/display/intel_fb_pin.c        | 107 +++++----
 drivers/gpu/drm/i915/display/intel_fb_pin.h        |  17 +-
 drivers/gpu/drm/i915/display/intel_fbc.c           |  11 +-
 drivers/gpu/drm/i915/display/intel_fbdev.c         |  20 +-
 drivers/gpu/drm/i915/display/intel_plane.c         |   3 +-
 drivers/gpu/drm/i915/i915_initial_plane.c          |   2 +-
 drivers/gpu/drm/xe/display/xe_fb_pin.c             |  74 +++---
 drivers/gpu/drm/xe/display/xe_initial_plane.c      |   6 +-
 drivers/gpu/drm/xe/xe_vram.c                       |  23 +-
 drivers/hid/Kconfig                                |   1 +
 drivers/hid/hid-asus.c                             |   2 +-
 drivers/hid/hid-core.c                             |  11 +-
 drivers/hid/hid-ft260.c                            |  25 +-
 drivers/hid/hid-huawei.c                           |   5 +-
 drivers/hid/hid-hyperv.c                           |  27 ++-
 drivers/hid/hid-input.c                            |  20 +-
 drivers/hid/hid-magicmouse.c                       |  73 +++++-
 drivers/hid/hid-nintendo.c                         |  22 +-
 drivers/hid/hid-rapoo.c                            |   2 +-
 drivers/hid/hid-sensor-custom.c                    |  21 +-
 drivers/hid/hid-uclogic-core.c                     |  12 +-
 drivers/hid/usbhid/hid-pidff.c                     |  13 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |   2 +
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h        |   1 +
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |  15 +-
 drivers/iommu/iommufd/ioas.c                       |   4 +
 drivers/mailbox/mailbox-mchp-ipc-sbi.c             |   2 +
 drivers/net/ethernet/pensando/ionic/ionic_lif.c    |  17 +-
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c   |   7 +-
 drivers/net/usb/rndis_host.c                       |   6 +-
 drivers/nfc/fdp/i2c.c                              |  27 +++
 drivers/nfc/microread/microread.c                  |  31 ++-
 drivers/nfc/pn533/pn533.c                          |   1 +
 drivers/nfc/st21nfca/dep.c                         |   3 +
 drivers/nvme/target/admin-cmd.c                    |   2 +-
 drivers/nvme/target/fabrics-cmd-auth.c             |   2 +-
 drivers/nvme/target/fc.c                           |   2 +-
 drivers/nvme/target/pci-epf.c                      |  10 +-
 drivers/nvme/target/tcp.c                          |  19 +-
 drivers/pci/controller/pci-host-generic.c          |  11 +-
 drivers/pci/ecam.c                                 |  13 +
 drivers/video/fbdev/core/fb_chrdev.c               |   6 +-
 drivers/video/fbdev/core/fbcon.c                   |   2 -
 drivers/video/fbdev/core/fbmem.c                   |  13 +
 drivers/video/fbdev/core/fbsysfs.c                 |  48 +++-
 drivers/video/fbdev/ps3fb.c                        |   5 +-
 drivers/video/fbdev/sh_mobile_lcdcfb.c             |   5 +-
 fs/exec.c                                          |   8 +-
 fs/ext4/crypto.c                                   |  40 ++--
 fs/ext4/fast_commit.c                              |  16 +-
 fs/ext4/ialloc.c                                   |   4 +
 fs/ext4/inode.c                                    |  11 +-
 fs/ext4/super.c                                    |   2 +-
 fs/ext4/xattr.c                                    |   7 +-
 fs/nilfs2/ioctl.c                                  |  20 +-
 fs/ocfs2/xattr.c                                   |  18 +-
 fs/xfs/libxfs/xfs_attr_leaf.c                      |  14 ++
 fs/xfs/scrub/agheader.c                            |  94 ++++++--
 fs/xfs/scrub/agheader_repair.c                     |  17 +-
 fs/xfs/scrub/bmap.c                                |   8 +-
 fs/xfs/scrub/common.c                              |  10 +-
 fs/xfs/scrub/common.h                              |   2 +
 fs/xfs/scrub/dir.c                                 |   2 +-
 fs/xfs/scrub/dirtree.c                             |   4 +-
 fs/xfs/scrub/metapath.c                            |   6 +-
 fs/xfs/scrub/nlinks.c                              |  12 +-
 fs/xfs/scrub/parent.c                              |   6 +-
 fs/xfs/scrub/rtbitmap.c                            |  12 +-
 fs/xfs/scrub/rtsummary.c                           |  12 +-
 fs/xfs/xfs_trans.c                                 |  16 +-
 include/linux/fb.h                                 |   2 +
 include/linux/futex.h                              |   2 +
 include/linux/hid.h                                |   2 +
 include/linux/io_uring_types.h                     |   8 +
 include/linux/pci-ecam.h                           |   3 +
 include/linux/sched.h                              |   8 +
 include/linux/wait.h                               |   1 +
 include/linux/wait_bit.h                           |   1 +
 io_uring/eventfd.c                                 |   8 +-
 io_uring/eventfd.h                                 |   2 +-
 io_uring/futex.c                                   |  32 ++-
 io_uring/futex.h                                   |   1 +
 io_uring/io-wq.c                                   |   9 +-
 io_uring/io_uring.c                                |   2 +-
 io_uring/opdef.c                                   |   2 +-
 io_uring/poll.c                                    |  23 +-
 io_uring/rsrc.c                                    |   2 +-
 io_uring/tw.c                                      |   2 +-
 io_uring/uring_cmd.c                               |   8 +-
 io_uring/waitid.c                                  |   2 +-
 kernel/futex/core.c                                | 126 ++++++----
 kernel/futex/futex.h                               |   9 +
 kernel/futex/pi.c                                  | 125 +++++++---
 kernel/kcov.c                                      |  90 +++----
 kernel/sched/wait.c                                |  15 ++
 kernel/sched/wait_bit.c                            |  14 +-
 lib/Kconfig.debug                                  |   5 +-
 net/bluetooth/hci_event.c                          |   8 +-
 net/bluetooth/hci_sync.c                           |  46 +++-
 net/bluetooth/iso.c                                |  32 ++-
 net/bluetooth/mgmt.c                               |   8 +
 net/bluetooth/rfcomm/core.c                        |  24 +-
 net/ipv4/ip_output.c                               |   4 +
 net/ipv6/ip6_output.c                              |   2 +
 net/mptcp/options.c                                |   2 +-
 net/mptcp/pm.c                                     |  68 +++---
 net/mptcp/pm_kernel.c                              |  10 +-
 net/mptcp/pm_userspace.c                           |   8 +-
 net/mptcp/protocol.h                               |  21 +-
 net/mptcp/subflow.c                                |   4 +-
 net/nfc/digital_technology.c                       |   2 +
 net/nfc/llcp_commands.c                            |  18 +-
 net/nfc/llcp_core.c                                |  15 +-
 net/nfc/nci/ntf.c                                  |  36 ++-
 net/nfc/nci/rsp.c                                  |   1 +
 security/selinux/include/security.h                |   1 +
 security/selinux/ss/avtab.c                        |  35 ++-
 security/selinux/ss/avtab.h                        |  13 +
 security/selinux/ss/conditional.c                  |  18 +-
 security/selinux/ss/constraint.h                   |   1 +
 security/selinux/ss/policydb.c                     | 248 +++++++++++++++----
 security/selinux/ss/policydb.h                     |  31 ++-
 security/selinux/ss/services.c                     |   8 +-
 sound/drivers/dummy.c                              |   6 +
 sound/usb/fcp.c                                    |  38 +--
 sound/usb/mixer.c                                  |   6 +
 sound/usb/mixer.h                                  |   2 +
 sound/usb/mixer_scarlett2.c                        |  98 +++++---
 137 files changed, 1957 insertions(+), 853 deletions(-)

Read the cover letter in its thread