6.18.50-rc2 review
Greg Kroah-Hartman
maintainercover 6.18.50-rc2 review
This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:07 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc2.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.50-rc2
Dev Jain <[email protected]>
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
Lorenzo Stoakes <[email protected]>
mm: avoid unnecessary use of is_swap_pmd()
Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Injae Ryou <[email protected]>
selftests/mm: fix on-fault-limit false failure under sudo-rs
Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels
Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()
Thomas Weißschuh (Schneider Electric) <[email protected]>
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character
Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()
Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites
Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output
Oleg Nesterov <[email protected]>
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Xu Rao <[email protected]>
zloop: truncate finished zones to zone capacity
Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read
Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order
Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7996: validate default EEPROM firmware size
Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: cancel mlo_pm_work on stop
Bryam Vargas <[email protected]>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Dawei Feng <[email protected]>
wifi: rtw88: pci: fix resource leak on failed NAPI setup
Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Abdun Nihaal <[email protected]>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
Runyu Xiao <[email protected]>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface
Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface
Fan Wu <[email protected]>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Dawei Feng <[email protected]>
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
Claudiu Beznea <[email protected]>
i3c: renesas: Reconfigure the DATBAS register on re-attach
Claudiu Beznea <[email protected]>
i3c: renesas: Clean DATBAS register on detach
Claudiu Beznea <[email protected]>
i3c: renesas: Check that the transfer is valid before accessing it
Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()
Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len
Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path
Runyu Xiao <[email protected]>
i3c: master: adi: initialize the lock before enabling interrupts
Jianyun Gao <[email protected]>
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
Jianyun Gao <[email protected]>
dm-pcache: fix implicit u8 truncation of gc_percent in message handler
Bryam Vargas <[email protected]>
dm-pcache: only hand out initialized cache segments
Bryam Vargas <[email protected]>
dm-pcache: detect a cycle in the last-kset chain during replay
Bryam Vargas <[email protected]>
dm-pcache: clamp the tail kset read to the segment data region
Bryam Vargas <[email protected]>
dm-pcache: bound the persisted tail-position offset
Bryam Vargas <[email protected]>
dm-pcache: validate on-media seg_num against the cache device size
Bryam Vargas <[email protected]>
dm-pcache: validate kset key_num and intra-segment bounds
Bryam Vargas <[email protected]>
dm-pcache: validate geometry fields from on-disk cache_info
Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails
Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Yehyeong Lee <[email protected]>
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
Miguel Ojeda <[email protected]>
rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
Ralf Lici <[email protected]>
ovpn: run deferred work on a module-owned workqueue
Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring buffer readers
Zhang Heng <[email protected]>
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
Denis Batishchev <[email protected]>
ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe
Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe
Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe
Xu Rao <[email protected]>
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect
Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe
Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device
Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove
Thomas Richard <[email protected]>
mfd: cgbc: Fix teardown ordering in cgbc_remove()
Can Peng <[email protected]>
hwrng: stm32 - Fix runtime PM cleanup on registration failure
Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation
Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()
Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom
Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet
Hidayath Khan <[email protected]>
net/smc: stop killed, freed and out_of_sync sharing a byte
Yehyeong Lee <[email protected]>
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()
Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
Yehyeong Lee <[email protected]>
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure
Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops
Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling
Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers
Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down
Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks
Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails
Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown
Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock
Christian Marangi <[email protected]>
net: phylink: correctly validate returned PCS in phylink_inband_caps
Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion
Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors
Jorijn van der Graaf <[email protected]>
net: ipa: fix stalled modem TX queue after runtime resume
Runyu Xiao <[email protected]>
net: ibm: emac: mal: fix NAPI locking
Ahmad Fatoum <[email protected]>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()
Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout
Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Corey Minyard <[email protected]>
ipmi:msghandler: Cancel work cleanly on an error
Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration
Yuho Choi <[email protected]>
ipmi: Remove all sysfs files on registration failure
Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length
Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Laxman Acharya Padhya <[email protected]>
io_uring/query: cap user size passed to copy_struct_to_user
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements
Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number
Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix current password length check
Thorsten Blum <[email protected]>
platform/x86: think-lmi: Free system certificate signatures
Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix certificate thumbprint sysfs output
Julian Haarmann <[email protected]>
platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Return error during profile addition
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for frequency and priority
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for core power state
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Use PP level enable mask
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add a NULL check for sst_inst[]
Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure
Fan Wu <[email protected]>
mmc: via-sdmmc: cancel card-detect work on remove
HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls
HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
Peiyang He <[email protected]>
iommufd: Fix UAF in selftest IOPF reporting
Shuai Xue <[email protected]>
iommufd: Release current IOAS on xa_store() failure
Shuai Xue <[email protected]>
iommufd: Avoid locking internal accesses during unmap
Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled
Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in
Peiyang He <[email protected]>
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm
Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
Shuai Xue <[email protected]>
iommu/sva: Set handle->dev before the SVA handle is visible
Weimin Xiong <[email protected]>
iommu/msm: Unwind probe state on registration failure
Shuai Xue <[email protected]>
iommu/amd: Put PCI device after handling PPR faults
Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions
Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access
Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages
Max Lee <[email protected]>
PCI/ASPM: Avoid L0s for Realtek RTS525A
Lukas Wunner <[email protected]>
PCI/AER: Fix mapping of errors to agent & layer
Lukas Wunner <[email protected]>
PCI/AER: Emit TLP Log only for unmasked errors
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix read byte order in pci_read_legacy_io()
Tim Harvey <[email protected]>
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
Ali Tariq <[email protected]>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
Ali Tariq <[email protected]>
PCI: plda: Fix use-after-free of event IRQs during teardown
Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#
Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery
Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful
Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend
Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check
Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors
Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove
Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm
Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown
HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware
Fan Wu <[email protected]>
power: supply: qcom_battmgr: fix use-after-free
Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove
Fan Wu <[email protected]>
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count
Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs
Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak
Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger
Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove
Jun Yang <[email protected]>
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup
Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion
Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed
Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted
Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes
Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command
Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure
Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page
Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure
Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop
Yifei Gao <[email protected]>
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
Ruoyu Wang <[email protected]>
i2c: mxs: fix DMA channel leak on probe error
Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range
Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings
Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
Karl Mehltretter <[email protected]>
arm64: proton-pack: Restore the nospectre_bhb command-line option
Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation
HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop
Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels
Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator
Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler
Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler
Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion
Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks
Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure
Shibo Zhu <[email protected]>
PM: sleep: Unblock runtime PM when device prepare fails
Vincent Donnefort <[email protected]>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
Vincent Donnefort <[email protected]>
ring-buffer: Free cpu_buffer::free_page with subbuf_order
Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT
WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
Jason Gunthorpe <[email protected]>
RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_write_cm_event()
Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()
Brett Creeley <[email protected]>
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove
Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing
Abdifatah Suruur <[email protected]>
ptp: vmclock: prevent read-only mappings from becoming writable
Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup
Nam Cao <[email protected]>
riscv: unaligned: stop using kthread for check_vector_unaligned_access()
Peixin Xie <[email protected]>
riscv: acpi: Handle LPI architectural context loss flags
Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
Jakob Unterwurzacher <[email protected]>
arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
Michael Scott <[email protected]>
arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
Oren Klopfer <[email protected]>
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check
Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Cong Nguyen <[email protected]>
media: staging/ipu7: fix async notifier UAF on probe error path
Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port
Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors
Wentao Guan <[email protected]>
wifi: mt76: mt7925: cancel pending mlo_pm_work
Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count
Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction
Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure
Chris Mason <[email protected]>
svcrdma: Reject Write/Reply chunks with segcount 0
Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer
Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails
Chris Mason <[email protected]>
svcrdma: Fix unmatched rn_unregister on failed accept
Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks
Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range
Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback
Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options
Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry
Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks
Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
Luxiao Xu <[email protected]>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
Jeff Layton <[email protected]>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation
Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail
Ameer Hamza <[email protected]>
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()
Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length
Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
Chris Mason <[email protected]>
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Felix Gu <[email protected]>
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
Jiacheng Yu <[email protected]>
params: fix charp corruption on allocation failure
Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
Stanislaw Gruszka <[email protected]>
module/kallsyms: fix nextval for data symbol lookup
Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()
Thiébaud Weksteen <[email protected]>
module: validate string table section types
Coly Li <[email protected]>
md: do overflow check for sb->bblog_shift in super_1_load()
Yunye Zhao <[email protected]>
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
Günther Noack <[email protected]>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions
Andrea Mayer <[email protected]>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels
Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
Zhiling Zou <[email protected]>
ip: orphan prefetched skbs before multicast forwarding
Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Max Kellermann <[email protected]>
jbd2: check need_resched() when skipping busy checkpoint buffers
Max Kellermann <[email protected]>
jbd2: bound shrinker scans by examined checkpoint buffers
Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug
Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling
Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Lorenzo Stoakes (ARM) <[email protected]>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Zhenhao Wan <[email protected]>
cxl/features: bound fwctl command payload to the input buffer
Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow
Kuan-Wei Chiu <[email protected]>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's
Bryam Vargas <[email protected]>
dm array: validate array block headers on read
Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()
liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure
Mikulas Patocka <[email protected]>
dm-io: report non-retryable errors separatedly
Keith Busch <[email protected]>
dm-io: clone the source bio instead of copying its biovec
Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
Jia Zhu <[email protected]>
buffer: avoid tail commit walk for uptodate folios
Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack
Vineet Gupta <[email protected]>
bpf, x86: Fix per-CPU address resolution into an extended register
Joe Damato <[email protected]>
bnxt_en: Write doorbell when linearizing skb fails
Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path
HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()
Junjie Cao <[email protected]>
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure
Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()
Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()
TanZheng <[email protected]>
ACPI: APEI: GHES: fix ARM section length accounting after header
Nirmoy Das <[email protected]>
ACPI: APEI: Fix ERST timeout unit conversion
Terry Bowman <[email protected]>
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
ZhaoJinming <[email protected]>
accel/rocket: Fix error path handling in rocket_job_run()
Shuvam Pandey <[email protected]>
accel/rocket: initialize job domain before cleanup paths
Muhammad Bilal <[email protected]>
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
Guillaume Morin <[email protected]>
hugetlb: only adjust reservation during unmapping if mapcount is 0
Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure
Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed
Chengfeng Ye <[email protected]>
fanotify: fix use-after-free of file range info
Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler
Yichong Chen <[email protected]>
ecryptfs: show filename encryption options
Yichong Chen <[email protected]>
ecryptfs: release message context on send failure
Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets
HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser
Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue
Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check
Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer
Konstantin Komarov <[email protected]>
fs/ntfs3: bound page_lcns[] index by the log record
Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay
Deepanshu Kartikey <[email protected]>
eventfs: Initialize ei->children and ei->list in init_ei()
Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: validate report size before copy
Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()
Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop
Baul Lee <[email protected]>
HID: universal-pidff: stop the device when force-feedback init fails
Doruk Tan Ozturk <[email protected]>
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure
Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device
Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received
Stuart Hayhurst <[email protected]>
HID: corsair-void: Check size of status and firmware events before reading them
Andre Eikmeyer <[email protected]>
HID: apple: preserve keyboard backlight across T2 resume
Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints
Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop
Fredric Cover <[email protected]>
smb: client: clear ce->tgthint in free_tgts()
Frank Sorenson <[email protected]>
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
Frank Sorenson <[email protected]>
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Frank Sorenson <[email protected]>
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove
Qu Wenruo <[email protected]>
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
Shuangpeng Bai <[email protected]>
btrfs: fix extent map leak in NOCOW direct I/O write
Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure
Matthew Brown <[email protected]>
ceph: fix leaked inode reference on writeback abort at umount
Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible
Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()
Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3
Michael Bommarito <[email protected]>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name
Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids
Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance
Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown
Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference
Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
Jeff Layton <[email protected]>
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
Jeff Layton <[email protected]>
nfsd: initialize DRC hash table before registering shrinker
Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it
Chris Mason <[email protected]>
nfsd: hold rcu across localio cmpxchg retry
Chris Mason <[email protected]>
nfsd: gate nfs3 setacl by argp->mask
Chuck Lever <[email protected]>
nfsd: gate nfs2 setacl by argp->mask
Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()
Jeff Layton <[email protected]>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
Jeff Layton <[email protected]>
nfsd: fix reply size estimate for GET_DIR_DELEGATION
Jeff Layton <[email protected]>
nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
Nikol Kuklev <[email protected]>
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
Jeff Layton <[email protected]>
nfsd: fix nfsd_file leak on inter-server COPY setup failure
Jeff Layton <[email protected]>
nfsd: fix netlink dumpit error handling for rpc_status_get
Jeff Layton <[email protected]>
nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
Jeff Layton <[email protected]>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state
Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
Jeff Layton <[email protected]>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
Jeff Layton <[email protected]>
nfsd: don't free session slots that are still in use
Jeff Layton <[email protected]>
nfsd: defer vfree of compound ops to fix rpc_status UAF
Jeff Layton <[email protected]>
nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
Jeff Layton <[email protected]>
nfsd: clear opcnt on compound arg release to prevent OOB read
Jeff Layton <[email protected]>
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid
Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Jeff Layton <[email protected]>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()
Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE
Jeff Layton <[email protected]>
nfsd: validate sockaddr length per family in listener_set
Jeff Layton <[email protected]>
nfsd: validate nseconds in TIME_DELEG decode paths
Chris Mason <[email protected]>
nfsd: size fh_verify server sockaddr slot by xpt_locallen
Zhenghang Xiao <[email protected]>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop
Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails
Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error
Jeff Layton <[email protected]>
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
Tim Menninger <[email protected]>
pNFS: Fix EBUSY check in pnfs_layout_need_return
Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Chris Mason <[email protected]>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit
Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock
Nate Prodromou <[email protected]>
NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
Chris Mason <[email protected]>
NFS/localio: fix ref leak on nfs_uuid_add_file failure
Longlong Xia <[email protected]>
zsmalloc: account for handle size in class lookup
Sergey Senozhatsky <[email protected]>
zram: validate deflate params
Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check
Jason Yang <[email protected]>
phy: rockchip-samsung-dcphy: fix out-of-range max_register
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser
Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder
Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow
Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Jeffin Philip <[email protected]>
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown
Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
Fan Wu <[email protected]>
usb: typec: thunderbolt: Disable work before freeing tbt on remove
Xu Yang <[email protected]>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords
Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
Pei Xiao <[email protected]>
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value
Karl Mehltretter <[email protected]>
serial: imx: serialize imx_uart_ports[] lifetime
Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount
Bryam Vargas <[email protected]>
misc: nsm: bound the device-reported response length
Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()
Prasanna Kumar T S M <[email protected]>
cdx: Fix double free when sysfs file creation fails
Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers
Deepanshu Kartikey <[email protected]>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
Vincent Donnefort <[email protected]>
tracing: Fix logged instance name on creation failure
Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()
Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication
Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O
Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling
Yao Zi <[email protected]>
x86/locking: Use sfence for wmb() if SSE is available
Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__
Ridong Chen <[email protected]>
mm: vmscan: fix node reclaim ignoring swappiness parameter
Johannes Weiner <[email protected]>
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
Vlastimil Babka (SUSE) <[email protected]>
mm: page_alloc: move capture_control to the page allocator
Johannes Weiner <[email protected]>
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
Johannes Weiner <[email protected]>
mm: mempolicy: fix automatic numa balancing for shmem
Guopeng Zhang <[email protected]>
mm: memcontrol: update state_local when flushing NMI stats
Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded
Guopeng Zhang <[email protected]>
mm: memcg-v1: fix memsw and TCP failcnt accounting
Guopeng Zhang <[email protected]>
mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
Johannes Weiner <[email protected]>
mm: compaction: support non-movable compaction for pageblock requests
Hao Jia <[email protected]>
mm/zswap: fix global shrinker when memory cgroup is disabled
Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
Hyunwoo Kim <[email protected]>
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
Ye Liu <[email protected]>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
Alexander Graf <[email protected]>
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks
David Hildenbrand (Arm) <[email protected]>
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
Breno Leitao <[email protected]>
mm, swap: ratelimit bad swap entry reports
Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline
Hyunwoo Kim <[email protected]>
apparmor: fix out-of-bounds write when null terminating a label vec
Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()
Chengfeng Ye <[email protected]>
KEYS: trusted: Fix TPM teardown ordering
Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled
Nikolai Grlica <[email protected]>
rust: kernel: list: fix incorrect pop_back example comment
FUJITA Tomonori <[email protected]>
rust: bug: fix warn_on macro build error on UML
FUJITA Tomonori <[email protected]>
rust: bug: skip arch-specific asm in testlib builds
Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump
Baokun Li <[email protected]>
fs: fix user path of nested backing files
Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
WenTao Liang <[email protected]>
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space
FUJITA Tomonori <[email protected]>
rust: time: fix as_micros_ceil() rounding near i64::MAX
Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
Fangzhi Zuo <[email protected]>
drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
Jerry Zuo <[email protected]>
drm/amd/display: hide Apple Studio Display secondary tile
Timur Kristóf <[email protected]>
drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)
Roman Li <[email protected]>
drm/amd/display: Skip PHY SSC reduction on some 8K panels
David Howells <[email protected]>
netfs: Fix missing locking around retry adding new subreqs
Rong Zhang <[email protected]>
platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
Christian Brauner <[email protected]>
nsfs: tighten permission checks for handle opening
Daniel Borkmann <[email protected]>
bpf: Fix incorrect pruning due to atomic fetch precision tracking
Eric Dumazet <[email protected]>
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
Rochan Avlur <[email protected]>
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
Zilin Guan <[email protected]>
wifi: ath11k: fix memory leaks in beacon template setup
Zilin Guan <[email protected]>
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/include/asm/acpi.h | 19 ++ arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/s390/kernel/perf_cpum_cf.c | 221 +++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 +++ arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 +++-- drivers/acpi/pfr_update.c | 45 ++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/bluetooth/btrtl.c | 13 -- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ----- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/cxl.h | 3 +- drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 114 ++++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 ++ drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++-- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 70 +++++- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++-- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 ++- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +-- drivers/md/dm-io.c | 96 ++++---- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 ++ drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 ++- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 ++- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 ++-- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 ++- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 +++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/aer.c | 29 ++- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 43 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/wmi-helpers.c | 4 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 ++- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/fat/misc.c | 4 + fs/fuse/dev.c | 3 +- fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 +++-- fs/netfs/read_retry.c | 6 +- fs/netfs/write_retry.c | 6 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 22 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/nfs2acl.c | 52 +++-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4callback.c | 113 +++++++-- fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 62 +++-- fs/nfsd/nfs4state.c | 253 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 26 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 129 ++++++++--- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/state.h | 3 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 34 +-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 5 +- fs/nsfs.c | 2 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 +++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 1 + fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 2 + include/linux/netdevice.h | 3 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 39 +++- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/bpf/verifier.c | 27 ++- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 --- kernel/reboot.c | 29 +++ kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 177 ++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++++---- mm/gup.c | 10 +- mm/huge_memory.c | 4 +- mm/hugetlb.c | 8 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 ++ mm/memory.c | 49 ++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/mm_init.c | 9 +- mm/page_alloc.c | 76 ++++++- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/pagewalk.c | 6 +- mm/rmap.c | 20 +- mm/swapfile.c | 6 +- mm/vmscan.c | 21 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +-- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++-- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++-- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +-- net/smc/smc_llc.c | 122 +++++++--- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 +++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/kernel/bug.rs | 8 +- rust/kernel/list.rs | 2 +- rust/kernel/time.rs | 17 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 +++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 504 files changed, 5464 insertions(+), 2549 deletions(-)
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.18.50-rc2-gf06ee4caaca3 #1 SMP PREEMPT_DYNAMIC Sat Sep 5 12:12:27 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:07 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc2.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.18.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Am 05.09.2026 um 13:58 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 8 lines · On Sat, 05 Sep 2026 13:58:59 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 07 Sep 2026 11:55:07 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64 and arm32:
Now that the huge_ptep_get issue is fixed, in UML I noticed that we still fail to build due to:
error[E0433]: failed to resolve: could not find `CStrExt` in `str`
--> drivers/android/binder/freeze.rs:109:13
|
109 | kernel::warn_on!(freeze.num_cleared_duplicates != 0);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ could not find `CStrExt` in `str`
|
= note: this error originates in the macro `$crate::warn_flags` which comes from the expansion of the macro `kernel::warn_on` (in Nightly builds, run with -Z macro-backtrace for more info)To fix it, this patch can be dropped:
https://lore.kernel.org/stable/CANiq72=EounScE9CxhQVRYTMe6XxgZzfid_cJZ5dxmkz7MQ2kw@mail.gmail.com/
Thanks!
Cheers,
Miguel