6.12.109-rc2 review
Greg Kroah-Hartman
maintainercover 6.12.109-rc2 review
This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-rc2.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.109-rc2
Dev Jain <[email protected]>
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
Lorenzo Stoakes <[email protected]>
mm: avoid unnecessary use of is_swap_pmd()
Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels
Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()
Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character
Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()
Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites
Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output
Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read
Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order
Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Dawei Feng <[email protected]>
wifi: rtw88: pci: fix resource leak on failed NAPI setup
Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Abdun Nihaal <[email protected]>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
Runyu Xiao <[email protected]>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface
Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface
Fan Wu <[email protected]>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()
Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len
Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path
Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails
Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Sean Christopherson <[email protected]>
KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test
Miguel Ojeda <[email protected]>
rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
Ashish Kalra <[email protected]>
x86/sev: Fix broken SNP support with KVM module built-in
Gao Shiyuan <[email protected]>
iommu/amd: remove return value of amd_iommu_detect
Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring buffer readers
Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe
Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe
Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect
Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe
Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device
Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove
Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation
Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()
Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom
Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet
Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()
Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure
Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops
Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers
Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down
Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks
Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails
Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown
Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock
Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion
Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors
Jorijn van der Graaf <[email protected]>
net: ipa: fix stalled modem TX queue after runtime resume
Ahmad Fatoum <[email protected]>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()
Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout
Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration
Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length
Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number
Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Return error during profile addition
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for frequency and priority
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for core power state
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Use PP level enable mask
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add a NULL check for sst_inst[]
Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure
HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls
HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled
Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in
Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm
Shuai Xue <[email protected]>
iommu/sva: Set handle->dev before the SVA handle is visible
Shuai Xue <[email protected]>
iommu/amd: Put PCI device after handling PPR faults
Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions
Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access
Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages
Max Lee <[email protected]>
PCI/ASPM: Avoid L0s for Realtek RTS525A
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
Tim Harvey <[email protected]>
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
Ali Tariq <[email protected]>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
Ali Tariq <[email protected]>
PCI: plda: Fix use-after-free of event IRQs during teardown
Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#
Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery
Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful
Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend
Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check
Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors
Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove
Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm
Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown
HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware
Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove
Fan Wu <[email protected]>
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count
Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs
Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak
Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger
Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove
Jun Yang <[email protected]>
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup
Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion
Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed
Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted
Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes
Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command
Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure
Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page
Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure
Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop
Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range
Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings
Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation
HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop
Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels
Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator
Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler
Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler
Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion
Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks
Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure
Vincent Donnefort <[email protected]>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
Vincent Donnefort <[email protected]>
ring-buffer: Free cpu_buffer::free_page with subbuf_order
Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT
WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()
Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove
Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing
Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup
Peixin Xie <[email protected]>
riscv: acpi: Handle LPI architectural context loss flags
Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check
Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port
Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors
Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count
Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction
Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure
Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer
Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails
Chris Mason <[email protected]>
svcrdma: Fix unmatched rn_unregister on failed accept
Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks
Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range
Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback
Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options
Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry
Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks
Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation
Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail
Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()
Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length
Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
Chris Mason <[email protected]>
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Jiacheng Yu <[email protected]>
params: fix charp corruption on allocation failure
Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()
Coly Li <[email protected]>
md: do overflow check for sb->bblog_shift in super_1_load()
Yunye Zhao <[email protected]>
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions
Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels
Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Max Kellermann <[email protected]>
jbd2: check need_resched() when skipping busy checkpoint buffers
Max Kellermann <[email protected]>
jbd2: bound shrinker scans by examined checkpoint buffers
Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug
Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling
Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Lorenzo Stoakes (ARM) <[email protected]>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow
Kuan-Wei Chiu <[email protected]>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's
Bryam Vargas <[email protected]>
dm array: validate array block headers on read
Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()
liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure
Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack
Vineet Gupta <[email protected]>
bpf, x86: Fix per-CPU address resolution into an extended register
Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path
HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()
Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure
Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()
Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()
TanZheng <[email protected]>
ACPI: APEI: GHES: fix ARM section length accounting after header
Nirmoy Das <[email protected]>
ACPI: APEI: Fix ERST timeout unit conversion
Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure
Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed
Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler
Yichong Chen <[email protected]>
ecryptfs: show filename encryption options
Yichong Chen <[email protected]>
ecryptfs: release message context on send failure
Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets
HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser
Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue
Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check
Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer
Konstantin Komarov <[email protected]>
fs/ntfs3: bound page_lcns[] index by the log record
Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay
Deepanshu Kartikey <[email protected]>
eventfs: Initialize ei->children and ei->list in init_ei()
Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()
Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop
Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure
Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device
Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received
Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints
Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop
Fredric Cover <[email protected]>
smb: client: clear ce->tgthint in free_tgts()
Frank Sorenson <[email protected]>
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove
Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure
Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible
Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()
Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3
Michael Bommarito <[email protected]>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name
Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids
Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance
Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown
Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference
Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
Jeff Layton <[email protected]>
nfsd: initialize DRC hash table before registering shrinker
Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it
Chris Mason <[email protected]>
nfsd: gate nfs3 setacl by argp->mask
Chuck Lever <[email protected]>
nfsd: gate nfs2 setacl by argp->mask
Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()
Jeff Layton <[email protected]>
nfsd: fix reply size estimate for GET_DIR_DELEGATION
Jeff Layton <[email protected]>
nfsd: fix nfsd_file leak on inter-server COPY setup failure
Jeff Layton <[email protected]>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state
Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
Jeff Layton <[email protected]>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
Jeff Layton <[email protected]>
nfsd: defer vfree of compound ops to fix rpc_status UAF
Jeff Layton <[email protected]>
nfsd: clear opcnt on compound arg release to prevent OOB read
Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid
Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Jeff Layton <[email protected]>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()
Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE
Chris Mason <[email protected]>
nfsd: size fh_verify server sockaddr slot by xpt_locallen
Zhenghang Xiao <[email protected]>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop
Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails
Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error
Tim Menninger <[email protected]>
pNFS: Fix EBUSY check in pnfs_layout_need_return
Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Chris Mason <[email protected]>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit
Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock
Longlong Xia <[email protected]>
zsmalloc: account for handle size in class lookup
Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check
Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser
Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder
Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow
Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown
Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
Xu Yang <[email protected]>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords
Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value
Karl Mehltretter <[email protected]>
serial: imx: serialize imx_uart_ports[] lifetime
Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount
Bryam Vargas <[email protected]>
misc: nsm: bound the device-reported response length
Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()
Prasanna Kumar T S M <[email protected]>
cdx: Fix double free when sysfs file creation fails
Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers
Deepanshu Kartikey <[email protected]>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
Vincent Donnefort <[email protected]>
tracing: Fix logged instance name on creation failure
Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()
Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication
Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O
Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling
Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__
Johannes Weiner <[email protected]>
mm: mempolicy: fix automatic numa balancing for shmem
Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded
Hao Jia <[email protected]>
mm/zswap: fix global shrinker when memory cgroup is disabled
Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
Ye Liu <[email protected]>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks
Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline
Hyunwoo Kim <[email protected]>
apparmor: fix out-of-bounds write when null terminating a label vec
Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()
Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled
Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump
Baokun Li <[email protected]>
fs: fix user path of nested backing files
Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space
Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
Zilin Guan <[email protected]>
wifi: ath11k: fix memory leaks in beacon template setup
Zilin Guan <[email protected]>
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs
Mario Limonciello <[email protected]>
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
Ming Lei <[email protected]>
block: mark GFP_NOIO around sysfs ->store()
Chao Yu <[email protected]>
f2fs: fix potential deadloop in prepare_compress_overwrite()
Yang Erkun <[email protected]>
md: make rdev_addable usable for rcu mode
Michael Chan <[email protected]>
bnxt_en: Mask the bd_cnt field in the TX BD properly
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 4 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 3 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/huge_memory.c | 4 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/memory.c | 49 +++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/rmap.c | 60 ++++-- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 371 files changed, 3772 insertions(+), 1885 deletions(-)
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.12.109-rc2-gffa41b797906 #1 SMP PREEMPT_DYNAMIC Sat Sep 5 12:09:19 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Greg Kroah-Hartman wrote on Sat, Sep 05, 2026 at 01:58:50PM +0200:
Quoted 5 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-rc2.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.
Thanks for the v2! Looks good to me.
Tested ffa41b797906 ("Linux 6.12.109-rc2") on:
- arm i.MX6ULL (Armadillo 640)
- arm64 i.MX8MP (Armadillo G4)
No obvious regression in dmesg or basic tests:
Signature · 1 line
Dominique Martinet
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-rc2.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Am 05.09.2026 um 13:58 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 8 lines · On Sat, 05 Sep 2026 13:58:50 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:05 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Thanks!
Cheers,
Miguel