Skip to content

6.12.108-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest99 patches 11 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/99RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qpdrivers/infiniband/sw/rxe/rxe_qp.c+14 -10 replies
2/99RDMA/rxe: Fix OOB in free_rd_atomic_resources()drivers/infiniband/sw/rxe/rxe_qp.c+1 -20 replies
3/99KVM: x86/mmu: Check write tracking in all address spacesarch/x86/kvm/mmu/page_track.c+26 -60 replies
4/99ext4: dont enable DAX on new encrypted filesfs/ext4/crypto.c fs/ext4/ialloc.c+24 -200 replies
5/99io_uring/io-wq: fix worker accounting when canceling creation callbacksio_uring/io-wq.c+6 -30 replies
6/99nvme-tcp: fix usage of page_frag_cachedrivers/nvme/host/tcp.c+8 -00 replies
7/99HID: uhid: convert to hid_safe_input_report()drivers/hid/uhid.c+4 -40 replies
8/99selinux: use known type instead of void pointersecurity/selinux/ss/avtab.c security/selinux/ss/avtab.h security/selinux/ss/conditional.c +5 more+77 -740 replies
9/99selinux: avoid unnecessary indirection in struct level_datumsecurity/selinux/ss/mls.c security/selinux/ss/policydb.c security/selinux/ss/policydb.h+10 -170 replies
10/99selinux: make more use of str_read() when loading the policysecurity/selinux/ss/conditional.c security/selinux/ss/policydb.c security/selinux/ss/policydb.h+12 -220 replies
11/99selinux: use u16 for security classessecurity/selinux/ss/policydb.c security/selinux/ss/policydb.h security/selinux/ss/services.c+9 -80 replies
12/99selinux: more strict policy parsingsecurity/selinux/include/security.h security/selinux/ss/avtab.c security/selinux/ss/avtab.h +5 more+232 -600 replies
13/99selinux: reject a permission value exceeding the class permission countsecurity/selinux/ss/policydb.c+3 -00 replies
14/99selinux: require a classs permission values to cover its permission countsecurity/selinux/ss/policydb.c+46 -50 replies
15/99perf: Reject exited events as group leaderskernel/events/core.c+10 -00 replies
16/99jfs: add check read-only before truncation in jfs_truncate_nolock()fs/jfs/inode.c+1 -10 replies
17/99jfs: add check read-only before txBeginAnon() callfs/jfs/jfs_extent.c+10 -00 replies
18/99ibmvnic: Use kernel helpers for hex dumpsdrivers/net/ethernet/ibm/ibmvnic.c+18 -120 replies
19/99jfs: Fix null-ptr-deref in jfs_ioc_trimfs/jfs/jfs_discard.c+2 -10 replies
20/99exfat: fix double free in delayed_freefs/exfat/nls.c+1 -00 replies
21/99media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c+1 -00 replies
22/99mISDN: hfcpci: Fix warning when deleting uninitialized timerdrivers/isdn/hardware/mISDN/hfcpci.c+5 -70 replies
23/99can: j1939: implement NETDEV_UNREGISTER notification handlernet/can/j1939/j1939-priv.h net/can/j1939/main.c net/can/j1939/socket.c+53 -00 replies
24/99can: j1939: add missing calls in NETDEV_UNREGISTER notification handlernet/can/j1939/main.c+2 -00 replies
25/99can: j1939: make j1939_sk_bind() fail if device is no longer registerednet/can/j1939/socket.c+6 -00 replies
26/99smc: Fix use-after-free in __pnet_find_base_ndev().net/smc/smc_pnet.c+22 -210 replies
27/99KVM: arm64: Prevent access to vCPU events before initarch/arm64/kvm/arm.c+6 -00 replies
28/99smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().net/smc/smc_clc.c+22 -190 replies
29/99smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().net/smc/smc_clc.c+13 -130 replies
30/99ASoC: nau8821: Cancel delayed work on component removesound/soc/codecs/nau8821.c+9 -00 replies
31/99bpf: Fix use-after-free in offloaded map/prog info fillkernel/bpf/offload.c+4 -60 replies
32/99riscv: Fix register corruption from uninitialized cregs on errorarch/riscv/kernel/compat_signal.c arch/riscv/kernel/ptrace.c+4 -20 replies
33/99Revert "PM: sleep: Use complete() in device_pm_sleep_init()"drivers/base/power/main.c+1 -50 replies
34/99ASoC: nau8821: Cancel pending work before suspendsound/soc/codecs/nau8821.c+4 -00 replies
35/99smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().net/smc/smc_core.c+12 -150 replies
36/99selinux: switch two allocations to use kzalloc_objs()security/selinux/ss/conditional.c+3 -40 replies
37/99ring buffer: Propagate __rb_map_vma return value to callerkernel/trace/ring_buffer.c+1 -10 replies
38/99veth: fix OOB txq access in veth_poll() with asymmetric queue countsdrivers/net/veth.c+2 -10 replies
39/99powerpc/hv-gpci: fix preempt count leak in sysfs show pathsarch/powerpc/perf/hv-gpci.c+16 -80 replies
40/99ksmbd: harden file lifetime during session teardownfs/smb/server/smb2pdu.c fs/smb/server/vfs_cache.c fs/smb/server/vfs_cache.h+164 -250 replies
41/99nilfs2: correct return value kernel-doc descriptions for ioctl functionsfs/nilfs2/ioctl.c+95 -1360 replies
42/99nilfs2: reject invalid block index in GC ioctlfs/nilfs2/ioctl.c+18 -20 replies
43/99nfc: nci: add data_len bound checks to activation parameter extractorsnet/nfc/nci/ntf.c+22 -40 replies
44/99HID: pidff: Rework pidff_set_time() to fix warningsdrivers/hid/usbhid/hid-pidff.c+2 -20 replies
45/99HID: pidff: Use ARRAY_SIZE macro instead of sizeofdrivers/hid/usbhid/hid-pidff.c+24 -240 replies
46/99HID: pidff: clang-format passdrivers/hid/usbhid/hid-pidff.c+26 -290 replies
47/99HID: pidff: fix OOB write when hid->inputs is emptydrivers/hid/usbhid/hid-pidff.c+10 -30 replies
48/99HID: asus: simplify RGB init sequencedrivers/hid/hid-asus.c+22 -300 replies
49/99HID: asus: fix missing hid_is_usb() checkdrivers/hid/hid-asus.c+1 -10 replies
50/99HID: ft260: validate i2c input report lengthdrivers/hid/hid-ft260.c+14 -20 replies
51/99HID: ft260: fix stack-use-after-return write in I2C read racedrivers/hid/hid-ft260.c+24 -10 replies
52/99HID: uclogic: fix use-after-free of inrange_timer on removedrivers/hid/hid-uclogic-core.c+11 -10 replies
53/99Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()net/bluetooth/hci_sync.c+1 -10 replies
54/99Bluetooth: hci_sync: Fix accept list UAF during suspendnet/bluetooth/hci_sync.c+39 -110 replies
55/99HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()drivers/hid/hid-magicmouse.c+20 -50 replies
56/99fpga: dfl: fme: add error handlingdrivers/fpga/dfl-fme-perf.c+2 -00 replies
57/99accessibility: speakup: unregister tty ldisc on later init failuresdrivers/accessibility/speakup/main.c+1 -00 replies
58/99usb: xhci: Handle USB3 port events when there is one roothubdrivers/usb/host/xhci-ring.c+1 -10 replies
59/99xhci: dbgtty: Fix unregister on tty_register_driver() failuredrivers/usb/host/xhci-dbgtty.c+1 -00 replies
60/99xhci: dbgtty: Fix unregister on tty_alloc_driver() failuredrivers/usb/host/xhci-dbgtty.c+11 -50 replies
61/99fuse: fix invalidate lock leak on setattr writeback failurefs/fuse/dir.c+4 -50 replies
62/99fuse: fix invalidate lock leak on open O_TRUNC DAX failurefs/fuse/file.c+2 -20 replies
63/99usb: usbtest: disable dynamic ID supportdrivers/usb/misc/usbtest.c+1 -00 replies
64/99usb: gadget: f_tcm: keep port count until LUN teardown completesdrivers/target/target_core_fabric_configfs.c drivers/usb/gadget/function/f_tcm.c include/target/target_core_fabric.h+11 -10 replies
65/99tls: device: fix out-of-bounds write in tls_append_frag()net/tls/tls_device.c+2 -10 replies
66/99gtp: serialize PDP context updatesdrivers/net/gtp.c+17 -40 replies
67/99x86/CPU/AMD: Carve out a Zen5 models rangearch/x86/kernel/cpu/amd.c+1 -00 replies
68/99net/tcp: fix TCP-AO key deletion in VRFsnet/ipv4/tcp_ao.c+3 -00 replies
69/99tcp: fix AO info use-after-free in tcp_ao_connect_init()net/ipv4/tcp_ao.c+1 -60 replies
70/99net/tcp-ao: fix use-after-free of current_key on reconnect to another peernet/ipv4/tcp_ao.c+9 -00 replies
71/99xfrm: espintcp: fix UAF during closenet/xfrm/espintcp.c+2 -10 replies
72/99xfrm: drop ESP-in-TCP packets with no ingress devicenet/xfrm/espintcp.c+6 -00 replies
73/99xfrm: avoid lock inversion in nat keepalive worknet/xfrm/xfrm_nat_keepalive.c+48 -90 replies
74/99xfrm: ah6: validate routing header segments_leftnet/ipv6/ah6.c+18 -110 replies
75/99xfrm: fix xfrm_state_construct() auth-trunc leaknet/xfrm/xfrm_user.c+1 -10 replies
76/99xfrm: bound nat keepalive state collectionnet/xfrm/xfrm_nat_keepalive.c+21 -250 replies
77/99net: bridge: mcast: fix use-after-free of a master VLANs multicast contextnet/bridge/br_multicast.c+2 -20 replies
78/99ipv6: seg6: clear IPv4 control block on IPIP decapsulationnet/ipv6/seg6_local.c+7 -00 replies
79/99batman-adv: reject unrepresentable multicast TVLV offsetsinclude/linux/skbuff.h net/batman-adv/tvlv.c+28 -10 replies
80/99vxlan: keep the last remote linked during FDB flushdrivers/net/vxlan/vxlan_core.c+5 -40 replies
81/99netfilter: nf_tables: dont queue packet path object notificationsnet/netfilter/nf_tables_api.c+23 -130 replies
82/99mm/swap: reject swapon() on filesystem-level encrypted filesDocumentation/filesystems/fscrypt.rst mm/swapfile.c+11 -00 replies
83/99crypto: qcom-rng - Enable clock in hwrng casedrivers/crypto/qcom-rng.c+16 -00 replies
84/99crypto: qcom-rng - Allow zero as a random numberdrivers/crypto/qcom-rng.c+0 -20 replies
85/99crypto: qcom-rng - Remove crypto_rng interfacedrivers/crypto/Kconfig drivers/crypto/qcom-rng.c+19 -1400 replies
86/99crypto: atmel-tdes - use scatterlist length before DMA mappingdrivers/crypto/atmel-tdes.c+2 -30 replies
87/99crypto: qce - fix CCM AAD buffer underallocationdrivers/crypto/qce/aead.c+1 -10 replies
88/99crypto: mxs-dcp - fix source scatterlist length accessdrivers/crypto/mxs-dcp.c+1 -10 replies
89/99crypto: qce - Remove unsafe/deprecated algorithmsdrivers/crypto/qce/aead.c drivers/crypto/qce/common.c drivers/crypto/qce/common.h +4 more+20 -2390 replies
90/99KVM: s390: vsie: zero stale crypto bitsarch/s390/kvm/vsie.c+1 -00 replies
91/99usb: core: Add lock to usb_wakeup_notification()drivers/usb/core/hub.c+3 -00 replies
92/99usb: core: Strengthen error handling in hub_hub_status()drivers/usb/core/hub.c+3 -10 replies
93/99ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()sound/usb/midi.c+2 -00 replies
94/99ALSA: usb-audio: Complete cleanup after system-resume errorssound/usb/card.c+10 -40 replies
95/99USB: serial: option: fix slab OOB read in interrupt URB callbackdrivers/usb/serial/option.c+17 -30 replies
96/99USB: serial: spcp8x5: drop broken carrier detect supportdrivers/usb/serial/spcp8x5.c+0 -130 replies
97/99USB: c67x00: fix use-after-free in c67x00_add_iso_urb()drivers/usb/c67x00/c67x00-sched.c+2 -20 replies
98/99wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skbdrivers/net/wireless/mediatek/mt76/mt7925/mac.c+4 -00 replies
99/99usb: usbfs: fix use-after-free of usb_device in usbdev_release()drivers/usb/core/devio.c+1 -10 replies

Reviews trailers per patch

43 of 99 patches have a Reviewed-by or Acked-by.

PatchZhu YanjunStephen SmalleyDisha GoelOjaswin MujooJan KaraGabriel Krisman BertaziLee JonesDylan J. WolffJiacheng XuEric DumazetDongliang MuDaniel BorkmannRitesh Harjani (IBM)Namjae JeonOleg MakarenkoBenjamin TissoiresIlpo JärvinenMichael ZaidmanAlec HallXu YilunsyzbotOleksij RempelDave MarquardtSimon HormanDavid AhernDmitry SafonovPaolo AbeniBreno LeitaoRen WeiNikolay AleksandrovAndrea MayerSven EckelmannIdo SchimmelBaoquan HeMuhammad Usama AnjumDarrick J. WongDmitry BaryshkovKonrad DybcioBartosz GolaszewskiFrank LiEric BiggersKuldeep SinghClaudio Imbrenda[email protected]Alan SternFrancesco DolciniFlorian FainelliBrett A C SheffieldPeter SchneiderDominique MartinetHarshit MogalapalliPavel Machek (CIP)Shuah KhanMiguel OjedaRon EconomosBarry K. Nathan
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/99R-b
2/99R-b
3/99
4/99T-b R-b R-b
5/99R-b
6/99
7/99R-b
8/99
9/99
10/99
11/99A-b
12/99A-b
13/99A-b
14/99A-b
15/99
16/99
17/99
18/99R-b R-b
19/99Reported-and-tested-by Reported-and-tested-by
20/99
21/99
22/99
23/99T-b T-b A-b
24/99T-b A-b
25/99A-b
26/99R-b
27/99
28/99R-b
29/99R-b
30/99
31/99R-b A-b
32/99
33/99
34/99
35/99R-b
36/99
37/99
38/99
39/99R-b
40/99A-b
41/99
42/99
43/99
44/99
45/99R-b
46/99
47/99
48/99A-b R-b
49/99
50/99
51/99R-b
52/99
53/99
54/99
55/99R-b T-b
56/99R-b
57/99
58/99
59/99
60/99
61/99
62/99
63/99T-b
64/99
65/99
66/99
67/99
68/99R-b A-b
69/99R-b
70/99R-b A-b
71/99R-b
72/99R-b
73/99
74/99
75/99
76/99
77/99A-b
78/99R-b
79/99A-b
80/99R-b
81/99
82/99R-b R-b R-b
83/99R-b R-b
84/99R-b R-b
85/99R-b
86/99
87/99R-b
88/99R-b
89/99A-b T-b
90/99R-b
91/99
92/99
93/99
94/99
95/99
96/99
97/99
98/99
99/99R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 56 reviewers.

Read the v1 thread

Cover letter [PATCH 6.12 00/99] 6.12.108-rc1 review

This is the start of the stable review cycle for the 6.12.108 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.108-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.108-rc1

Miguel Peñaranda <[email protected]>
usb: usbfs: fix use-after-free of usb_device in usbdev_release()

Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

Shuangpeng Bai <[email protected]>

    USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

Johan Hovold <[email protected]>
USB: serial: spcp8x5: drop broken carrier detect support

Jiale Yao <[email protected]>
USB: serial: option: fix slab OOB read in interrupt URB callback

Will Porter <[email protected]>
ALSA: usb-audio: Complete cleanup after system-resume errors

Marouane El Moufid <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

Griffin Kroah-Hartman <[email protected]>
usb: core: Strengthen error handling in hub_hub_status()

Griffin Kroah-Hartman <[email protected]>
usb: core: Add lock to usb_wakeup_notification()

Christian Borntraeger <[email protected]>
KVM: s390: vsie: zero stale crypto bits

Bartosz Golaszewski <[email protected]>
crypto: qce - Remove unsafe/deprecated algorithms

Thorsten Blum <[email protected]>
crypto: mxs-dcp - fix source scatterlist length access

Md Sadre Alam <[email protected]>
crypto: qce - fix CCM AAD buffer underallocation

Thorsten Blum <[email protected]>
crypto: atmel-tdes - use scatterlist length before DMA mapping

Eric Biggers <[email protected]>
crypto: qcom-rng - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: qcom-rng - Allow zero as a random number

Eric Biggers <[email protected]>
crypto: qcom-rng - Enable clock in hwrng case

Eric Biggers <[email protected]>
mm/swap: reject swapon() on filesystem-level encrypted files

Fourie Zhang <[email protected]>
netfilter: nf_tables: don't queue packet path object notifications

Kyle Zeng <[email protected]>
vxlan: keep the last remote linked during FDB flush

Kyle Zeng <[email protected]>
batman-adv: reject unrepresentable multicast TVLV offsets

Kyle Zeng <[email protected]>
ipv6: seg6: clear IPv4 control block on IPIP decapsulation

Norbert Szetei <[email protected]>
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

Zihan Xi <[email protected]>
xfrm: bound nat keepalive state collection

Zihan Xi <[email protected]>
xfrm: fix xfrm_state_construct() auth-trunc leak

Asim Viladi Oglu Manizada <[email protected]>
xfrm: ah6: validate routing header segments_left

Zihan Xi <[email protected]>
xfrm: avoid lock inversion in nat keepalive work

Zhiling Zou <[email protected]>
xfrm: drop ESP-in-TCP packets with no ingress device

Sabrina Dubroca <[email protected]>
xfrm: espintcp: fix UAF during close

Hyunwoo Kim <[email protected]>
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

Qing Ming <[email protected]>
tcp: fix AO info use-after-free in tcp_ao_connect_init()

Rastislav Szabo <[email protected]>
net/tcp: fix TCP-AO key deletion in VRFs

Pratik Vishwakarma <[email protected]>
x86/CPU/AMD: Carve out a Zen5 models range

Qing Ming <[email protected]>
gtp: serialize PDP context updates

Jiayuan Chen <[email protected]>
tls: device: fix out-of-bounds write in tls_append_frag()

Shuangpeng Bai <[email protected]>
usb: gadget: f_tcm: keep port count until LUN teardown completes

Aleksandr Nogikh <[email protected]>
usb: usbtest: disable dynamic ID support

Baokun Li <[email protected]>
fuse: fix invalidate lock leak on open O_TRUNC DAX failure

Baokun Li <[email protected]>
fuse: fix invalidate lock leak on setattr writeback failure

Lucas De Marchi <[email protected]>
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure

Lucas De Marchi <[email protected]>
xhci: dbgtty: Fix unregister on tty_register_driver() failure

Semih Baskan <[email protected]>
usb: xhci: Handle USB3 port events when there is one roothub

Haoxiang Li <[email protected]>
accessibility: speakup: unregister tty ldisc on later init failures

Griffin Kroah-Hartman <[email protected]>
fpga: dfl: fme: add error handling

Jose Villaseñor Montfort <[email protected]>
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Fix accept list UAF during suspend

Zijun Hu <[email protected]>
Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()

Ibrahim Hashimov <[email protected]>
HID: uclogic: fix use-after-free of inrange_timer on remove

Raman Varabets <[email protected]>
HID: ft260: fix stack-use-after-return write in I2C read race

Michael Zaidman <[email protected]>
HID: ft260: validate i2c input report length

Jann Horn <[email protected]>
HID: asus: fix missing hid_is_usb() check

Antheas Kapenekakis <[email protected]>
HID: asus: simplify RGB init sequence

Baul Lee <[email protected]>

    HID: pidff: fix OOB write when hid->inputs is empty

Tomasz Pakuła <[email protected]>
HID: pidff: clang-format pass

Tomasz Pakuła <[email protected]>
HID: pidff: Use ARRAY_SIZE macro instead of sizeof

Tomasz Pakuła <[email protected]>
HID: pidff: Rework pidff_set_time() to fix warnings

Bryam Vargas <[email protected]>
nfc: nci: add data_len bound checks to activation parameter extractors

Ryusuke Konishi <[email protected]>
nilfs2: reject invalid block index in GC ioctl

Ryusuke Konishi <[email protected]>
nilfs2: correct return value kernel-doc descriptions for ioctl functions

DaeMyung Kang <[email protected]>
ksmbd: harden file lifetime during session teardown

Aboorva Devarajan <[email protected]>
powerpc/hv-gpci: fix preempt count leak in sysfs show paths

Jesper Dangaard Brouer <[email protected]>
veth: fix OOB txq access in veth_poll() with asymmetric queue counts

Ankit Khushwaha <[email protected]>
ring buffer: Propagate __rb_map_vma return value to caller

Stephen Smalley <[email protected]>
selinux: switch two allocations to use kzalloc_objs()

Kuniyuki Iwashima <[email protected]>

    smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().

Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Cancel pending work before suspend

Sasha Levin <[email protected]>
Revert "PM: sleep: Use complete() in device_pm_sleep_init()"

Michael Neuling <[email protected]>
riscv: Fix register corruption from uninitialized cregs on error

Jiayuan Chen <[email protected]>
bpf: Fix use-after-free in offloaded map/prog info fill

Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Cancel delayed work on component remove

Kuniyuki Iwashima <[email protected]>

    smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

Kuniyuki Iwashima <[email protected]>

    smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

Oliver Upton <[email protected]>
KVM: arm64: Prevent access to vCPU events before init

Kuniyuki Iwashima <[email protected]>
smc: Fix use-after-free in __pnet_find_base_ndev().

Tetsuo Handa <[email protected]>
can: j1939: make j1939_sk_bind() fail if device is no longer registered

Tetsuo Handa <[email protected]>
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler

Tetsuo Handa <[email protected]>
can: j1939: implement NETDEV_UNREGISTER notification handler

Vladimir Riabchun <[email protected]>
mISDN: hfcpci: Fix warning when deleting uninitialized timer

Wentao Liang <[email protected]>
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()

Namjae Jeon <[email protected]>
exfat: fix double free in delayed_free

Dylan Wolff <[email protected]>
jfs: Fix null-ptr-deref in jfs_ioc_trim

Nick Child <[email protected]>
ibmvnic: Use kernel helpers for hex dumps

Vasiliy Kovalev <[email protected]>
jfs: add check read-only before txBeginAnon() call

Vasiliy Kovalev <[email protected]>
jfs: add check read-only before truncation in jfs_truncate_nolock()

Kyle Zeng <[email protected]>
perf: Reject exited events as group leaders

Bryam Vargas <[email protected]>
selinux: require a class's permission values to cover its permission count

Bryam Vargas <[email protected]>
selinux: reject a permission value exceeding the class permission count

Christian Göttsche <[email protected]>
selinux: more strict policy parsing

Christian Göttsche <[email protected]>
selinux: use u16 for security classes

Christian Göttsche <[email protected]>
selinux: make more use of str_read() when loading the policy

Christian Göttsche <[email protected]>
selinux: avoid unnecessary indirection in struct level_datum

Christian Göttsche <[email protected]>
selinux: use known type instead of void pointer

Carlos Llamas <[email protected]>
HID: uhid: convert to hid_safe_input_report()

Dmitry Bogdanov <[email protected]>
nvme-tcp: fix usage of page_frag_cache

Vishnu Razdan <[email protected]>
io_uring/io-wq: fix worker accounting when canceling creation callbacks

Eric Biggers <[email protected]>
ext4: don't enable DAX on new encrypted files

Jinu Kim <[email protected]>
KVM: x86/mmu: Check write tracking in all address spaces

Peiyang He <[email protected]>
RDMA/rxe: Fix OOB in free_rd_atomic_resources()

Ibrahim Hashimov <[email protected]>
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

-------------

Diffstat:

 Documentation/filesystems/fscrypt.rst              |   4 +
 Makefile                                           |   4 +-
 arch/arm64/kvm/arm.c                               |   6 +
 arch/powerpc/perf/hv-gpci.c                        |  24 +-
 arch/riscv/kernel/compat_signal.c                  |   2 +
 arch/riscv/kernel/ptrace.c                         |   4 +-
 arch/s390/kvm/vsie.c                               |   1 +
 arch/x86/kernel/cpu/amd.c                          |   1 +
 arch/x86/kvm/mmu/page_track.c                      |  32 +-
 drivers/accessibility/speakup/main.c               |   1 +
 drivers/base/power/main.c                          |   6 +-
 drivers/crypto/Kconfig                             |   1 -
 drivers/crypto/atmel-tdes.c                        |   5 +-
 drivers/crypto/mxs-dcp.c                           |   2 +-
 drivers/crypto/qce/aead.c                          |  58 +---
 drivers/crypto/qce/common.c                        |  55 +--
 drivers/crypto/qce/common.h                        |  16 +-
 drivers/crypto/qce/regs-v5.h                       |   4 -
 drivers/crypto/qce/sha.c                           |  30 +-
 drivers/crypto/qce/sha.h                           |   1 -
 drivers/crypto/qce/skcipher.c                      |  97 +-----
 drivers/crypto/qcom-rng.c                          | 156 ++-------
 drivers/fpga/dfl-fme-perf.c                        |   2 +
 drivers/hid/hid-asus.c                             |  52 ++-
 drivers/hid/hid-ft260.c                            |  41 ++-
 drivers/hid/hid-magicmouse.c                       |  25 +-
 drivers/hid/hid-uclogic-core.c                     |  12 +-
 drivers/hid/uhid.c                                 |   8 +-
 drivers/hid/usbhid/hid-pidff.c                     | 106 +++---
 drivers/infiniband/sw/rxe/rxe_qp.c                 |  18 +-
 drivers/isdn/hardware/mISDN/hfcpci.c               |  12 +-
 .../platform/samsung/exynos4-is/fimc-is-regs.c     |   1 +
 drivers/net/ethernet/ibm/ibmvnic.c                 |  30 +-
 drivers/net/gtp.c                                  |  21 +-
 drivers/net/veth.c                                 |   3 +-
 drivers/net/vxlan/vxlan_core.c                     |  11 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   4 +
 drivers/nvme/host/tcp.c                            |   8 +
 drivers/target/target_core_fabric_configfs.c       |   8 +
 drivers/usb/c67x00/c67x00-sched.c                  |   4 +-
 drivers/usb/core/devio.c                           |   2 +-
 drivers/usb/core/hub.c                             |   7 +-
 drivers/usb/gadget/function/f_tcm.c                |   2 +-
 drivers/usb/host/xhci-dbgtty.c                     |  15 +-
 drivers/usb/host/xhci-ring.c                       |   2 +-
 drivers/usb/misc/usbtest.c                         |   1 +
 drivers/usb/serial/option.c                        |  20 +-
 drivers/usb/serial/spcp8x5.c                       |  13 -
 fs/exfat/nls.c                                     |   1 +
 fs/ext4/crypto.c                                   |  40 +--
 fs/ext4/ialloc.c                                   |   4 +
 fs/fuse/dir.c                                      |   9 +-
 fs/fuse/file.c                                     |   4 +-
 fs/jfs/inode.c                                     |   2 +-
 fs/jfs/jfs_discard.c                               |   3 +-
 fs/jfs/jfs_extent.c                                |  10 +
 fs/nilfs2/ioctl.c                                  | 251 +++++++-------
 fs/smb/server/smb2pdu.c                            |   6 +-
 fs/smb/server/vfs_cache.c                          | 179 ++++++++--
 fs/smb/server/vfs_cache.h                          |   4 +-
 include/linux/skbuff.h                             |  24 ++
 include/target/target_core_fabric.h                |   2 +
 io_uring/io-wq.c                                   |   9 +-
 kernel/bpf/offload.c                               |  10 +-
 kernel/events/core.c                               |  10 +
 kernel/trace/ring_buffer.c                         |   2 +-
 mm/swapfile.c                                      |   7 +
 net/batman-adv/tvlv.c                              |   5 +-
 net/bluetooth/hci_sync.c                           |  48 ++-
 net/bridge/br_multicast.c                          |   4 +-
 net/can/j1939/j1939-priv.h                         |   1 +
 net/can/j1939/main.c                               |   5 +
 net/can/j1939/socket.c                             |  55 +++
 net/ipv4/tcp_ao.c                                  |  19 +-
 net/ipv6/ah6.c                                     |  29 +-
 net/ipv6/seg6_local.c                              |   7 +
 net/netfilter/nf_tables_api.c                      |  36 +-
 net/nfc/nci/ntf.c                                  |  26 +-
 net/smc/smc_clc.c                                  |  67 ++--
 net/smc/smc_core.c                                 |  27 +-
 net/smc/smc_pnet.c                                 |  43 +--
 net/tls/tls_device.c                               |   3 +-
 net/xfrm/espintcp.c                                |   9 +-
 net/xfrm/xfrm_nat_keepalive.c                      |  53 ++-
 net/xfrm/xfrm_user.c                               |   2 +-
 security/selinux/include/security.h                |   1 +
 security/selinux/ss/avtab.c                        |  43 ++-
 security/selinux/ss/avtab.h                        |  21 +-
 security/selinux/ss/conditional.c                  |  47 +--
 security/selinux/ss/conditional.h                  |   6 +-
 security/selinux/ss/constraint.h                   |   1 +
 security/selinux/ss/ebitmap.c                      |   4 +-
 security/selinux/ss/ebitmap.h                      |   5 +-
 security/selinux/ss/mls.c                          |   6 +-
 security/selinux/ss/policydb.c                     | 375 +++++++++++++++------
 security/selinux/ss/policydb.h                     |  51 ++-
 security/selinux/ss/services.c                     |   8 +-
 sound/soc/codecs/nau8821.c                         |  13 +
 sound/usb/card.c                                   |  14 +-
 sound/usb/midi.c                                   |   2 +
 100 files changed, 1484 insertions(+), 1067 deletions(-)