Merge tag 'v6.18.44' into qcom-6.18.y by nsiddams · Pull Request #970 · qualcomm-linux/kernel

nsiddams (nsiddams) · 2026-08-18T07:15:52Z

No description provided.

[ Upstream commit 1842bf9 ] Commit 14a8570 ("sched/deadline: Use revised wakeup rule for dl_server") applies the revised wakeup rule to any server, as a result servers that are not running (dl_defer_running == 0) and start with a deadline overflow get enqueued and can boost tasks as if they were running, invalidating the defer rule and the documented state model. Apply the revised wakeup rule only for deferrable servers that are marked as running. Fixes: 14a8570 ("sched/deadline: Use revised wakeup rule for dl_server") Signed-off-by: Gabriele Monaco <gmonaco@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Juri Lelli <juri.lelli@redhat.com> Tested-by: Andrea Righi <arighi@nvidia.com> Link: https://patch.msgid.link/20260522125833.264145-1-gmonaco@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>

…orted SoCs [ Upstream commit 9c19d60 ] The commit f43579e ("spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection") introduced a global 166MHz cap for DTR mode (RXCLKSRC=3), based on the i.MX8MN datasheet timing specification (Section 3.9.9, page 65). After reviewing the FlexSPI timing parameters in the datasheets for all supported SoCs, the following corrections and additions are needed: 1. SDR mode (RXCLKSRC=0) limits vary per SoC: - i.MX8MN/MM/MP/95: 66MHz (IMX8MNCEC §3.9.9, IMX8MMCEC §3.9.10, IMX8MPCEC, IMX95CEC Rev.8 §4.11.7) - i.MX8QXP/QM/DXL/ULP: 60MHz (IMX8QXPCEC, IMX8QMCEC, IMX8DXLCEC, IMX8ULPCEC §7.3.1 ND mode) - LX2160A: 100MHz (LX2160ACEC FlexSPI timing parameters) 2. DTR mode (RXCLKSRC=3) limits vary per SoC: - i.MX8MN/MM/MP/ULP: 166MHz - i.MX8QXP/QM/DXL: 200MHz (same FlexSPI IP across this family) - i.MX95: 200MHz (IMX95CEC §4.11.7.3.2.3 Table 106) - LX2160A: DTR disabled (FSPI_QUIRK_DISABLE_DTR) Update related platform data with correct speed limation according to datasheet. Fixes: f43579e ("spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection") Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Link: https://patch.msgid.link/20260728-fspi-clock-v2-1-dbe786a4a6eb@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 451c907 ] A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 (qede): transmit queue 2 timed out 10226 ms [qede_tx_timeout:586(ens6f1)]TX timeout on queue 2! [qede_recovery_handler:2665(ens6f0)]Starting a recovery process The recovery path deadlocks on the driver's own mutex: qede_sp_task rtnl_lock() mutex_lock(&edev->qede_lock) <- taken qede_recovery_handler qede_load udp_tunnel_nic_reset_ntf __udp_tunnel_nic_device_sync info->sync_table == qede_udp_tunnel_sync mutex_lock(&edev->qede_lock) <- same task: deadlock The mutex is not recursive, so the kworker blocks on itself with rtnl_lock held, and neither lock is ever released. Every task that calls rtnl_lock() afterwards (ip, ovs-vswitchd, lldpad, IPv6 addrconf, sshd) blocks forever while the node still answers ping. In a vmcore from an affected production node rtnl_mutex.owner decodes to the very kworker blocked at the innermost mutex_lock() above. Re-sync the tunnel ports from qede_sp_task() after the internal lock is dropped, still under rtnl_lock as the udp_tunnel API requires. This mirrors qede_open(), which calls udp_tunnel_nic_reset_ntf() under rtnl without the internal lock. qede_recovery_handler() now returns whether it has successfully reloaded an open device, and the caller re-syncs the ports only in that case. This keeps the old gating exactly: a device that was down or a failed recovery returns false, as those paths never reached the udp_tunnel_nic_reset_ntf() call before either. This was the only user of the qede_lock()/qede_unlock() helpers, so remove them. Fixes: 8cd160a ("qede: convert to new udp_tunnel_nic infra") Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Andrew Lunn <andrew+netdev@lunn.ch> CC: "David S. Miller" <davem@davemloft.net> CC: Eric Dumazet <edumazet@google.com> CC: Jakub Kicinski <kuba@kernel.org> CC: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260726104311.1782900-1-den@openvz.org Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 1afb8ea ] HDMI 2.0 section 6.1.3.1 specifies that after enabling Scrambling_Enable and starting scrambled video transmission, the source should poll Scrambling_Status until it reads 1 or until a timeout of 200 ms expires. Add a polling step after enabling the HDMI port to check the scrambling status when HDMI scrambling is enabled. On some HDMI 2.0 sinks, omitting this check can result in 4K@60Hz (594 MHz) failing to come up correctly because the sink has not yet finished its scrambling setup. In practice, waiting for the scrambling status here fixes such sinks. While this synchronous polling is not itself explicitly required for correct modeset sequencing, HDMI 2.0 section 6.1.3.1 does recommend it as the way for the source to verify that the TMDS link is functioning correctly with scrambling enabled. v3: - Add explicit HDMI 2.0 section reference in code comment - Clarify commit message around the observed sink fix v2: - Poll TMDS_Scrambler_Status for up to 200 ms instead of using a fixed delay Reported-by: Jerome Tollet <jtollet@cisco.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6868 Link: https://lore.kernel.org/dri-devel/20251230091037.5603-1-jerome.tollet@gmail.com/ Signed-off-by: Jerome Tollet <jerome.tollet@gmail.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com> Link: https://patch.msgid.link/20260520022544.3097252-1-ankit.k.nautiyal@intel.com (cherry picked from commit b7d51d6) Fixes: 1595363 ("drm/i915: enable scrambling") Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit c5db4de ] ksmbd_close_fd() marks an open file as FP_CLOSED and drops the file table reference. If another in-flight request still holds a reference, the final close is deferred until that request drops its reference. The function currently returns -EINVAL in that deferred-final-close case because fp is cleared when the reference count does not reach zero. That turns a valid close into STATUS_FILE_CLOSED. smb2.compound_find.compound_find_close sends QUERY_DIRECTORY and then closes the same directory handle before receiving the find response. The query holds a reference while it builds the response, so close must mark the handle closed and return success even though final teardown is delayed. Track whether the handle was successfully transitioned to FP_CLOSED and return success when only the final close is deferred. Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Stable-dep-of: e718819 ("ksmbd: fix use-after-free in __close_file_table_ids()") Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit e718819 ] A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table. Fixes: 8510a04 ("ksmbd: increment reference count of parent fp") Reported-by: Yunseong Kim <yunseong.kim@est.tech> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit c679ce3 ] iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate bio_set to avoid this deadlock. Christian Brauner <brauner@kernel.org> says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot. Fixes: 5fcbd55 ("iomap: split bios to zone append limits in the submission handlers") Signed-off-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260629125229.3400726-1-hch@lst.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 0762262 ] mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers. Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 9d70ef7 ] Interrupt control structure (union hv_interupt_control) has different fields when it comes to x86 vs ARM64. Bring in the correct structure from HyperV header files and adjust the existing interrupt routing code accordingly. Signed-off-by: Jinank Jain <jinankjain@microsoft.com> Signed-off-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Stable-dep-of: 0289a67 ("mshv: Fix level-triggered check on uninitialized data") Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 0289a67 ] In mshv_irqfd_assign(), the level-triggered validation for resample irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before mshv_irqfd_update() has populated the field. Since the irqfd struct is zero-allocated, level_triggered is always 0 at that point, causing the check to always reject resample irqfds with -EINVAL. This makes level-triggered interrupt resampling — used to avoid interrupt storms with assigned devices — completely non-functional. Move the check after the mshv_irqfd_update() call, which resolves the IRQ routing entry and populates irqfd_lapic_irq with the actual trigger mode. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit b098dc8 ] mshv_partition_ioctl_create_vp() initialises a VP struct (allocations, mutex_init, init_waitqueue_head, page mappings) and then publishes the pointer into partition->pt_vp_array. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshv_try_assert_irq_fast() on the irqfd fast path. Of these, only mshv_try_assert_irq_fast() can structurally race the publish. It runs from an eventfd waker without holding pt_mutex, and MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in pt_vp_array before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vp_register_page). The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHV_RUN_VP on the VP fd returned by MSHV_CREATE_VP, which by construction is returned after the publish. Leave those readers as plain loads. Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish the pointer, and pair it with smp_load_acquire() in mshv_try_assert_irq_fast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path. The destroy-side path (destroy_partition() clearing pt_vp_array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here. Fixes: 621191d ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 339bd11 upstream. iommufd_vdevice_alloc_ioctl() takes idev->igroup->lock, then validates the driver's vdevice_size against the core structure size with a WARN_ON_ONCE. On failure that guard jumps to out_put_idev, below out_unlock_igroup, so it skips the mutex_unlock(), leaving the igroup lock held and deadlocking the next vDEVICE operation on that group. Jump to out_unlock_igroup instead. Fixes: ed42eee ("iommufd/viommu: Add driver-defined vDEVICE support") Link: https://patch.msgid.link/r/e903f775d491296a525097e2a90b3eb6a47cf2ef.1783311134.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Reviewed-by: Kevin Tian <kevin.tian@intel.com> Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Pranjal Shrivastava <praan@google.com> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9be311c upstream. iommufd_vdevice_alloc_ioctl() adds the vDEVICE to the viommu->vdevs xarray with xa_cmpxchg() before the driver's vdevice_init() op runs. That op is where a driver validates the device and may reject it, but the xarray entry is already live by then: a concurrent IOMMU_HWPT_INVALIDATE can look it up with iommufd_viommu_find_dev() and run the driver invalidation path against a device that vdevice_init() would have refused. Reserve the index with xa_insert(): it stores a zero entry that reads back as NULL, and returns -EBUSY on a duplicate virt_id. Run vdevice_init() and store the vDEVICE pointer only once it succeeds. A failed vdevice_init() releases the reservation, so lookups observe the vDEVICE only after it is fully initialized and accepted. Fixes: ed42eee ("iommufd/viommu: Add driver-defined vDEVICE support") Link: https://patch.msgid.link/r/1e05999347f4bf583edbc6a1312c857d5548708c.1783311134.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Reviewed-by: Kevin Tian <kevin.tian@intel.com> Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Pranjal Shrivastava <praan@google.com> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

…lace commit ba5c0f2 upstream. iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together with the handle of the device's *old* domain. This should be a parameter mismatch: 1. Semantically, iommufd_auto_response_faults(x, handle) scans x->fault's deliver list and response xarray for groups matching "handle". A group is queued under the hwpt that was attached at fault-delivery time. old_handle is fetched *before* the domain switch, so its group lives on old->fault, not on the new hwpt->fault. 2. Historically, the first argument was "old". The routine was introduced by commit b7d8833 ("iommufd: Fault-capable hwpt attach/detach/replace") as __fault_domain_replace_dev() in fault.c, correctly calling iommufd_auto_response_faults(old, curr). Commit fb21b15 ("iommufd: Make attach_handle generic than fault specific") moved this into iommufd_hwpt_replace_device() in device.c and swapped it to "hwpt". This should be a refactor regression, not an intentional change. Fix this by passing "old" instead. Link: https://patch.msgid.link/r/9D652384339C69D5+20260710122952.885325-1-peiyang_he@smail.nju.edu.cn Fixes: fb21b15 ("iommufd: Make attach_handle generic than fault specific") Cc: stable@vger.kernel.org Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 738e6f3 upstream. iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD. Link: https://patch.msgid.link/r/3CFD314D0FE4D7EC+20260720085017.3998878-2-peiyang_he@smail.nju.edu.cn Closes: https://lore.kernel.org/all/B4F28798E2E784CA+d29f723c-b2b5-4b67-8d1c-4f7b9b0b27cb@smail.nju.edu.cn/ Fixes: 34765cb ("iommufd: Associate fault object with iommufd_hw_pgtable") Cc: stable@vger.kernel.org Tested-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 25cb6e9 upstream. The driver calls ocelot_regmap_from_resource() via <linux/mfd/ocelot.h>, which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO. The Kconfig entry does not select REGMAP_MMIO, causing a build failure when no other driver in the config happens to pull in REGMAP_MMIO: include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio' Found by randconfig testing on arm64; tinyconfig reproducer below. Fixes: 2afbbab ("pinctrl: microchip-sgpio: update to support regmap") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Boortz <bennib@mailbox.org> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 015b5bc upstream. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure. Fixes: be4c60b ("pinctrl: devicetree: Avoid taking direct reference to device name string") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c9b47e6 upstream. fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded. Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly. Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected. Fixes: 622cead ("erofs: lzma compression support") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dad6e10 upstream. drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with .is_generic = true, but that field is only present when CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h). The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF, so any config that enables CONFIG_PINCTRL_BM1880=y without CONFIG_GENERIC_PINCONF=y fails to compile: drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic' Found by randconfig testing on arm64; tinyconfig reproducer below. Add the missing select to fix the build. Fixes: 49bd61e ("pinctrl: Add pinconf support for BM1880 SoC") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Boortz <bennib@mailbox.org> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c1f3e77 upstream. clang recently added support for -Wstringop-overread [1], which is on by default like -Wfortify-source. This breaks the usage of -Werror in the fortify tests, resulting in the following false positive warnings in the kernel build: warning: unsafe memcmp() usage lacked '__read_overflow2' warning in lib/test_fortify/read_overflow2-memcmp.c warning: unsafe memcmp() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memcmp.c warning: unsafe memchr() usage lacked '__read_overflow' warning in lib/test_fortify/read_overflow-memchr.c Examining the fortify test logs shows a warning like the following in each of the failed logs: In file included from lib/test_fortify/read_overflow2-memcmp.c:5: lib/test_fortify/test_fortify.h:34:2: error: 'memcmp' reading 17 bytes from a region of size 16 [-Werror,-Wstringop-overread] 34 | TEST; | ^ lib/test_fortify/read_overflow2-memcmp.c:3:2: note: expanded from macro 'TEST' 3 | memcmp(large, small, sizeof(small) + 1) | ^ 1 error generated. Disable -Wstringop-overread for the fortify tests, as it defeats the purpose of testing the Linux specific implementation of fortify, like -Wfortify-source. Cc: stable@vger.kernel.org Closes: ClangBuiltLinux/linux#2168 Link: llvm/llvm-project@86f2e71 [1] Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260623-fix-test_fortify-for-clang-stringop-overread-v1-1-15ee8342a953@kernel.org Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63867c8 upstream. pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks. Link: https://lore.kernel.org/20260708003955.4024340-1-wangkefeng.wang@huawei.com Link: https://lore.kernel.org/20260706111958.3649651-1-wangkefeng.wang@huawei.com Fixes: fd35ca3 ("mm/migrate_device.c: copy pte dirty bit to page") Fixes: 6c28760 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive") Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Reviewed-by: Balbir Singh <balbirs@nvidia.com> Acked-by: Zi Yan <ziy@nvidia.com> Cc: Alistair Popple <apopple@nvidia.com> Cc: Byungchul Park <byungchul@sk.com> Cc: David Hildenbrand <david@kernel.org> Cc: Gregory Price <gourry@gourry.net> Cc: "Huang, Ying" <ying.huang@linux.alibaba.com> Cc: Joshua Hahn <joshua.hahnjy@gmail.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Rakie Kim <rakie.kim@sk.com> Cc: Ying Huang <ying.huang@linux.alibaba.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7441d63 upstream. snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory remove on a 22 TB ppc64le LPAR, snapshot_page() oopsed on the page isolation path while reading an order-1 folio's __page_2 from an adjacent absent section (unmapped vmemmap). Fix this to avoid reading memmap that doesn't exist (e.g., a vmemmap hole). Link: https://lore.kernel.org/20260708201954.686111-1-aboorvad@linux.ibm.com Fixes: 31a31da ("mm: move _pincount in folio to page[2] on 32bit") Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Luiz Capitulino <luizcap@redhat.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> # v6.15+ Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e3a0127 upstream. fclog.c does not compile because it is missing fcntl.h, needed for O_RDONLY etc. There are also some redundant includes that are also in kselftest_harness.h. Link: https://lore.kernel.org/20260710171741.837308-1-jkoolstra@xs4all.nl Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Cc: Aleksa Sarai <cyphar@cyphar.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@gmail.com> Cc: Christian Brauner <brauner@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40de816 upstream. PAGEMAP_SCAN reports an unpopulated PTE in a uffd-wp VMA as written, but a range with no page table at all -- a PMD hole -- is skipped: pagemap_scan_pte_hole() tests p->cur_vma_category, which never carries PAGE_IS_WRITTEN, so the hole is neither reported nor (under PM_SCAN_WP_MATCHING) armed. In a uffd-wp VMA, WP_UNPOPULATED installs uffd-wp markers when protecting a range, allocating page tables as needed, so an unpopulated slot is treated as written -- see the pte_none() handling in pagemap_page_category(). A missing marker therefore means the range was zapped, e.g. via MADV_DONTNEED. This applies to anon and shmem VMAs. An anonymous THP is write-protected in place as a huge PMD, so a full-PMD MADV_DONTNEED clears it to pmd_none -- a hole with no page table -- and pagemap_scan_pte_hole() misses it. For a MAP_PRIVATE|MAP_ANON mapping MADV_DONTNEED has fill-with-zeros semantics, so a write-tracking checkpoint/migration tool (e.g. CRIU) treats the range as unchanged and keeps its previous contents; after restore or live migration the process reads stale data instead of zeroes -- data corruption. Report a hole in a non-hugetlb uffd-wp VMA as written, matching the pte_none handling in pagemap_page_category(); the existing PM_SCAN_WP_MATCHING path then arms it via uffd_wp_range(). hugetlb is excluded: pagemap_hugetlb_category() reports an empty hugetlb entry (huge_pte_none) as not-written, unlike pagemap_page_category(), which reports pte_none as written. pagemap_scan_pte_hole() fires for a hugetlb slot only when it has no page table; keeping that not-written matches how an allocated-but-empty hugetlb entry reads, so the hole and the empty-entry cases agree within the VMA. Link: https://lore.kernel.org/20260715144234.442721-2-kirill@shutemov.name Fixes: 2bad466 ("mm/uffd: UFFD_FEATURE_WP_UNPOPULATED") Signed-off-by: Kiryl Shutsemau <kas@kernel.org> Reported-by: Sashiko AI review <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260707151349.92143-1-kirill@shutemov.name Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Peter Xu <peterx@redhat.com> Cc: Jann Horn <jannh@google.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zenghui Yu <zenghui.yu@linux.dev> Assisted-by: Claude:claude-fable-5 Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 89b1b79 upstream. In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed. When nr_units > 1, the function writes beyond chunk->populated. Fix it by using chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. Commit a63d4ac ("percpu: make percpu-km set chunk->populated bitmap properly") introduced the bitmap overflow issue. Later, commit b539b87 ("percpu: implmeent pcpu_nr_empty_pop_pages and chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the accounting issue. Link: https://lore.kernel.org/20260709-fix-pcpu_create_chunk-in-percpu-km-v1-1-1f64745a84cc@nvidia.com Fixes: a63d4ac ("percpu: make percpu-km set chunk->populated bitmap properly") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1 Assisted-by: Codex:GPT-5 Signed-off-by: Zi Yan <ziy@nvidia.com> Acked-by: Dennis Zhou <dennis@kernel.org> Cc: Christoph Lameter <cl@linux.com> Cc: Tejun Heo <tj@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dd9623f upstream. allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired. The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips: list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330 ksys_mmap_pgoff+0x2a1/0x3e0 do_syscall_64+0xd7/0x420 Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack address into resv->region_cache, leading to later use-after-free. This was observed as a real host panic on a dense KVM host where a QEMU guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one shared resv_map. Use list_splice_init() so the source head is re-initialized empty after each splice, making the retry loop safe. Link: https://lore.kernel.org/20260713171456.300518-2-caixiangfeng@bytedance.com Fixes: d3ec7b6 ("mm/hugetlb: use list_splice to merge two list at once") Signed-off-by: Xiangfeng Cai <caixiangfeng@bytedance.com> Reviewed-by: Muchun Song <muchun.song@linux.dev> Cc: Baoquan He <baoquan.he@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@linux.alibaba.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea3034b upstream. A per-node vmstat counter is pgdat->vm_stat[] plus per-cpu deltas. A balanced counter can sit split as global=+N / per-cpu=-N. The folds reconciling the split only walk online nodes, so when try_offline_node() marks a node offline the per-cpu deltas are stranded. A subsequent online resets the per-cpu area but not pgdat->vm_stat[], orphaning the +N permanently. All NR_VM_NODE_STAT_ITEMS are affected. The existing code zeroes the per-cpu counters and causes a permanent skew. Fold the stranded deltas instead, before the node rejoins the online set. The node is not online yet and the hotplug lock is held, so the remote access to per-cpu values is safe. Discovered when node compaction hung for a nearly empty node, as the math to determine throttling broke. Reproduced by repeated memory hotplug/unplug cycles on a node under pressure: NR_ISOLATED_ANON ratchets up and never returns to zero. Link: https://lore.kernel.org/20260627202243.758289-1-gourry@gourry.net Fixes: 75ef718 ("mm, vmstat: add infrastructure for per-node vmstats") Signed-off-by: Gregory Price <gourry@gourry.net> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: Mike Rapoport <rppt@kernel.org> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 00a8ce2 upstream. traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e87 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable@vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aca0cd1 upstream. enable_trace_fprobe() sets the file link or the TP_FLAG_PROFILE flag and then registers each trace_fprobe in the probe list. If __register_trace_fprobe() fails partway through, the function returns immediately without unregistering the trace_fprobes it already registered or undoing the file link / flag it set, leaving the event half-enabled and leaking the registered fprobe(s). enable_trace_kprobe() already handles this with a rollback path. Do the same for fprobe: on failure, unregister all probes and clear the file link or profile flag. Link: https://lore.kernel.org/all/20260724064208.480030-1-raushan.jhon@gmail.com/ Fixes: 334e551 ("tracing/probes: Add fprobe events for tracing function entry and exit.") Cc: stable@vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e65cd9 upstream. VMCLEAR/VMREAD/VMWRITE/VMPTRLD access the internal VMCS cache, which is not visible to the compiler; without a memory clobber, the compiler can reorder them in troublesome ways because "asm volatile" and "asm goto" only protect against removal of the asm. For example, placing a VMWRITE before the corresponding VMCS pointer is loaded can lead to corruption. While none of this has been observed, it is better to prevent than cure. Likewise, INVEPT and INVVPID access the TLB and, even though in their case the effect is only visible to the next VMLAUNCH/VMRESUME, it is technically correct to add the clobber there too. So avoid any urge to special case them, and simply hardcode "memory" into the clobber list of vmx_asm1() and vmx_asm2(). __vmcs_readl() open-codes its own asm, so add the clobber there as well. Link: https://lore.kernel.org/kvm/CABgObfbL3t21yVeSwiLSjjOUER+rTYDPHYAH9YU4TWGRjx6XHg@mail.gmail.com/ Cc: Sean Christopherson <seanjc@google.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 48ab863 ] [Why] After unifying DCN interrupt sources under VUPDATE_NO_LOCK, we have two remaining issues to clean up: 1. On DCN, flip completion is now delivered from VUPDATE_NO_LOCK (dm_crtc_high_irq_handler) instead of GRPH_PFLIP. But VUPDATE_NO_LOCK fires every frame, regardless of whether a flip has latched. 2. There is a window during commit where a flip is armed (pflip_status = SUBMITTED) but not yet programmed into HW. If the VUPDATE_NO_LOCK fires in that window, its handler would deliver a flip event to userspace before HW has latched to it. If userspace then renders to what it believes is now the back buffer (but HW is still latched to it!), it will cause display corruption. This issue seemed to have been introduced by: commit 1159898 ("drm/amd/display: Handle commit plane with no FB.") Enabling replay or psr extended the duration of this window, and hence made corruption more likely to be observed. [How] * Move acrtc->event/pflip_status arming to after update_planes_and_stream_adapter() has programmed the flip into HW. This closes the window where pflip_status is SUBMITTED but the flip is not yet programmed. * Add dc_get_flip_pending_on_otg(), which reads the HUBP flip-pending status straight from HW for the pipe(s) bound to an OTG instance. It is keyed only by otg_inst and does not take or mutate a dc_plane_state, so it is safe to call from the OTG interrupt handler without racing a concurrent commit that may be modifying plane state. * Optimistically query for flip-pending after programming, in the event that HW latched to the new fb between programming start and arming event. If it latched, send the vblank event immediately, rather than wait for the next vblank IRQ. * In the VUPDATE_NO_LOCK handler, only deliver flip completion once dc_get_flip_pending_on_otg() reports the flip is no longer pending. Otherwise leave the flip armed and retry on the next vupdate. * For DCE, maintain the existing behavior of arming flips before programming, and relying on GRPH_FLIP to fire at HW latch. v2: * Drop flip_programmed completion object, instead move event/pflip_status arming after programming. * For DCN, optimistically query for flip pending immediately after programming, and if it latched, send event right away. v3: * Fix event timestamps on optimistic flip latch detection, where it's possible for it to run *before* the vupdate IRQ updates the timestamp. * Add more docstrings for DCN vblank handling. * Clean up if conditions in dm_arm_vblank_event(). * Code style cleanup on braces surrounding multi-line statements. Fixes: 9b47278 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/3787 Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141 Assisted-by: Copilot:claude-opus-4.8 Tested-by: Mario Limonciello (AMD) <superm1@kernel.org> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f64a9be) Cc: stable@vger.kernel.org # 8382cd2: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 8419331 ] [Why] We need to exit PSR/IPS before programming. Before calling DC for programming in amdgpu_dm_commit_planes(), there's a vblank_control_workqueue flush. This waits for IPS and PSR exit. (See drm_vblank_on/off() > amdgpu_dm_crtc_set_vblank() --queue_work()-> amdgpu_dm_crtc_vblank_control_worker()) Prior to the tagged "Fixes:" change, drm_vblank_get() was called before the workqueue flush. This ordering ensures that PSR exit occurred before programming. After the "Fixes:" change, drm_vblank_get() is called after the workqueue flush, leading to programming while idle optimizations are still active. This can lead to incorrect flip_pending detection used by vblank event delivery. [How] Split the vblank_get() component of `dm_arm_vblank_event()` into `dm_arm_vblank_event_pre_programming()`, which is called before programming. Call it before the vblank_control_workqueue flush. Includes a drive-by cleanup of prepare_flip_isr(): the only caller is dm_arm_vblank_event() and it's simple enough to roll-in. v2: Fix checkpatch formatting warning on drm_arm_vblank_event_pre_programming() arg alignment. Fixes: 48ab863 ("drm/amd/display: check GRPH_FLIP status before sending event") Cc: stable@vger.kernel.org Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141#note_3583205 Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5527 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Claude:opus-5 Suggested-by: David Weber <weber.aulendorf@gmail.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 05984e2) (cherry picked from commit 8419331) Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit b2bce0e ] Add xe_pat_index_get_comp_en() helper function to check whether compression is enabled for a given PAT index by extracting the XE2_COMP_EN bit from the PAT table entry. There are no current users, however there are multiple in-flight series which will all use this helper. CC: Nitin Gote <nitin.r.gote@intel.com> CC: Sanjay Yadav <sanjay.kumar.yadav@intel.com> CC: Matt Roper <matthew.d.roper@intel.com> Suggested-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Xin Wang <x.wang@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Nitin Gote <nitin.r.gote@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20251110221458.1864507-2-x.wang@intel.com Stable-dep-of: 7bc597c ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit be97fd0 ] Introduce an internal __xe_migrate_copy(..., is_vram_resolve) path and expose a small wrapper xe_migrate_resolve() that calls it with is_vram_resolve=true. For resolve/decompression operations we must ensure the copy code uses the compression PAT index when appropriate; this change centralizes that behavior and allows callers to schedule a resolve (decompress) operation via the migrate API. v3: Fix kernel-doc warnings v2: (Matt) - Simplify xe_migrate_resolve(), use single BO/resource; remove copy_only_ccs argument as it's always false. Cc: Matthew Brost <matthew.brost@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Nitin Gote <nitin.r.gote@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260304123758.3050386-7-nitin.r.gote@intel.com Stable-dep-of: 7bc597c ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit b67427f ] Add infrastructure for tracking purgeable state of buffer objects. This includes: Introduce enum xe_madv_purgeable_state with three states: - XE_MADV_PURGEABLE_WILLNEED (0): BO is needed and should not be purged. This is the default state for all BOs. - XE_MADV_PURGEABLE_DONTNEED (1): BO is not currently needed and can be purged by the kernel under memory pressure to reclaim resources. Only non-shared BOs can be marked as DONTNEED. - XE_MADV_PURGEABLE_PURGED (2): BO has been purged by the kernel. Accessing a purged BO results in error. Follows i915 semantics where once purged, the BO remains permanently invalid ("once purged, always purged"). Add madv_purgeable field to struct xe_bo for state tracking of purgeable state across concurrent access paths Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260326130843.3545241-3-arvind.yadav@intel.com Stable-dep-of: 7bc597c ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 4f44961 ] Add purge checking to vma_lock_and_validate() to block new mapping operations on purged BOs while allowing cleanup operations to proceed. Purged BOs have their backing pages freed by the kernel. New mapping operations (MAP, PREFETCH, REMAP) must be rejected with -EINVAL to prevent GPU access to invalid memory. Cleanup operations (UNMAP) must be allowed so applications can release resources after detecting purge via the retained field. REMAP operations require mixed handling - reject new prev/next VMAs if the BO is purged, but allow the unmap portion to proceed for cleanup. The check_purged flag in struct xe_vma_lock_and_validate_flags distinguishes between these cases: true for new mappings (must reject), false for cleanup (allow). Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260326130843.3545241-6-arvind.yadav@intel.com Stable-dep-of: 7bc597c ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 7bc597c ] When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA, the code used it as an index into region_to_mem_type[], causing an out-of-bounds access since the value is -1. Resolve the preferred location for BO VMAs directly: local VRAM on dGFX (using the BO's tile placement) or system memory on iGPU. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: -Fix null dereference Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: c1bb69a ("drm/xe/svm: Consult madvise preferred location in prefetch") Cc: Matthew Brost <matthew.brost@intel.com> Cc: stable@vger.kernel.org Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20260624174943.2808767-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> (cherry picked from commit d9a4906) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

…j[_reverse] [ Upstream commit ce44b78 ] Nobody makes any use of it. Possible internal future users can instead use the _index variable. External users shouldn't use it since the array it's pointing into is internal drm_exec state. v2: - Use a unique id for the loop variable (Christian) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260520101616.41284-2-thomas.hellstrom@linux.intel.com Stable-dep-of: af80e2b ("drm/xe: Wait on external BO kernel fences in exec IOCTL") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit af80e2b ] Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BOs (bo->vm == NULL), which carry their kernel operations (evictions, moves, ...) in their own dma-resv KERNEL slot. The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for memory management operations that must complete before the BO or its backing store may be used: any accessor is required to wait on the KERNEL fences before touching the resv. By skipping the external BOs' KERNEL slots, the exec path violated that contract and could schedule a user job while a kernel operation on an external BO mapped by the VM was still in flight, racing against it and potentially reading or writing memory that was being moved. Replace the VM-only dependency with an iteration over every object locked by the exec, adding each object's KERNEL slot as a job dependency. This covers the VM resv (rebinds and private BOs) as well as every external BO, mirroring the drm_gpuvm_resv_add_fence() call that later publishes the job fence to the same set of objects. Long-running mode continues to skip this, as before. Fixes: dd08ebf ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260702215805.4011228-1-matthew.brost@intel.com (cherry picked from commit a6b842a) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 4b274b0 ] There's no point in doing all the other checks in intel_vrr_is_capable() if the platform doesn't support VRR at all Check HAS_VRR() before wasting time on the other checks. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20251020185038.4272-23-ville.syrjala@linux.intel.com Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Stable-dep-of: f8a9262 ("drm/i915/vrr: require valid min/max vfreq for VRR") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit f8a9262 ] Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 117cd09 ("drm/i915/display/dp: Compute VRR state in atomic_check") Cc: stable@vger.kernel.org # v5.12+ Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 1765cf5) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 9ea9b45 ] We have helpers SVM range start, end, and size. Use them in the PT layer rather than directly looking at the struct. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://lore.kernel.org/r/20251022230122.922382-1-matthew.brost@intel.com Stable-dep-of: 6384271 ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 620a09f ] Stub out the new page fault layer and add kernel documentation. This is intended as a replacement for the GT page fault layer, enabling multiple producers to hook into a shared page fault consumer interface. v2: - Fix kernel doc typo (checkpatch) - Remove comment around GT (Stuart) - Add explaination around reclaim (Francois) - Add comment around u8 vs enum (Francois) - Include engine instance (Stuart) v3: - Fix XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION kernel doc (Stuart) Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com> Tested-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20251031165416.2871503-2-matthew.brost@intel.com Stable-dep-of: 6384271 ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 9b1a0e0 ] Starting from Xe3p, HW adds a feature assisting range based page reclamation. Introduce a bit in device info to indicate whether device has such capability. Signed-off-by: Oak Zeng <oak.zeng@intel.com> Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20251212213225.3564537-15-brian3.nguyen@intel.com Stable-dep-of: 6384271 ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 6384271 ] xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it. After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind. Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry. Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init(). v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org Fixes: e8babb2 ("drm/xe: Convert multiple bind ops into single job") Suggested-by: Matthew Auld <matthew.auld@intel.com> Cc: stable@vger.kernel.org Assisted-by: GitHub-Copilot:claude-sonnet-4.6 Signed-off-by: Zongyao Bai <zongyao.bai@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260714232433.2737533-1-zongyao.bai@intel.com (cherry picked from commit 0460455) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d4fb651 upstream. The can_skb_priv::skbcnt variable is used to identify CAN skbs in the RX path analogue to the skb->hash. As the skb hash is not filled in CAN skbs move the private skbcnt value to skb->hash and set skb->sw_hash accordingly. The skb->hash is a value used for RPS to identify skbs. Use it as intended. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-1-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 050f010 upstream. This patch is a follow-up to commit cf070fe ("can: isotp: serialize TX state transitions under so->rx_lock") which addresses following sashiko-bot findings: - isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim - isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a sleeping sendmsg() claim isn't stranded - isotp_sendmsg(): have both wait_event_interruptible() calls in isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotp_release() process. - isotp_sendmsg(): handle potential claim of a new transfer when the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->tx_gen before getting the lock at err_event_drop. - isotp_sendmsg(): handle a stuck can_send() and omit timer and state changes if a new transfer was claimed. wait_tx_done() returns the error recorded in so->tx_result[], tagged with the caller's own generation. - isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->tx_result[]; sk->sk_err is raised unconditionally, same as every other error path here. - isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire) before tx_gen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale tx_gen/tx_result slot. - isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we have read the result from so->tx_result[], so an already-reported error doesn't stay latched for a later poll()/SO_ERROR. Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses and use skb->hash as unique loopback echo frame indicator. Fixes: cf070fe ("can: isotp: serialize TX state transitions under so->rx_lock") Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260724181525.43556-1-socketcan@hartkopp.net Cc: stable@kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fb0bf28 upstream. The commit 7aa7d4b ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") consolidated port teardown into the ucsi_unregister_port() helper. However, it introduced an ordering problem in the ucsi_init() error path. Fix this by ensuring ucsi_unregister_port() is called before we unregister their corresponding lockdep keys. Cc: stable@vger.kernel.org Fixes: 7aa7d4b ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") Reported-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com> Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/ Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org> Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd64240 upstream. The name of the function __drm_fb_helper_initial_config_and_unlock() and also the comment above that function make it clear that all code paths in this function should unlock fb_helper->lock before returning. Add a mutex_unlock() call in the only code path where it is missing. This has been detected by the Clang thread-safety analyzer. Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Christian König <christian.koenig@amd.com> # radeon Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> # msm Cc: Javier Martinez Canillas <javierm@redhat.com> Fixes: 63c971a ("drm/fb-helper: Allocate and release fb_info in single place") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260403205355.1181984-1-bvanassche@acm.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d23bd83 upstream. That field already contains the value being assigned. No need to do this twice. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 63c971a ("drm/fb-helper: Allocate and release fb_info in single place") Cc: linux-tegra@vger.kernel.org Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260421073646.144712-2-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Link: https://lore.kernel.org/r/20260807143424.272339768@linuxfoundation.org Tested-by: Pavel Machek (CIP) <pavel@nabladev.com> Tested-by: Wentao Guan <guanwentao@uniontech.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

* refs/heads/1efe5d0 Linux 6.18.44 drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info drm/fb-helper: Fix a locking bug in an error path usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path can: isotp: fix timer drain order, wakeup handling and tx_gen ordering can: use skb hash instead of private variable in headroom drm/xe/pt: Reset current_op in xe_pt_update_ops_init() drm/xe: Add page reclamation info to device info drm/xe: Stub out new pagefault layer drm/xe: Use SVM range helpers in PT layer drm/i915/vrr: require valid min/max vfreq for VRR drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() drm/xe: Wait on external BO kernel fences in exec IOCTL drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC drm/xe/vm: Prevent binding of purged buffer objects drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support drm/xe/pat: Add helper to query compression enable status drm/amd/display: Exit idle optimizations before programming drm/amd/display: check GRPH_FLIP status before sending event drm/xe/guc: Fix buffer overflow in steered register list allocation drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions drm/amdgpu: Fix context pstate override handling drm/tegra: fbdev: Remove offset into framebuffer memory drm/fb-helper: Allocate and release fb_info in single place userfaultfd: prevent registration of special VMAs wifi: brcmfmac: drain bus_reset work on device removal media: uapi: rkisp: Correct name version enum media: qcom: camss: Fix RDI streaming for CSID 340 media: qcom: camss: csid-340: Fix unused variables media: chips-media: wave5: Support CBP profile usb: typec: ucsi: Fix race condition and ordering in port unregistration usb: typec: ucsi: split connector lock classes net/handshake: Drain pending requests at net namespace exit net/handshake: Close the submit-side sock_hold race net/handshake: hand off the pinned file reference to accept_doit net/handshake: Take a long-lived file reference at submit net/handshake: Fix null-ptr-deref in handshake_complete() net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() file: ensure cleanup file: add FD_{ADD,PREPARE}() mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() drm/xe/rtp: Ensure locking/ref counting for OA whitelists drm/xe/oa: (De-)whitelist OA registers on OA stream open/release drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs drm/xe/rtp: Save OA nonpriv registers to register save/restore lists drm/xe/rtp: Generalize whitelist_apply_to_hwe drm/xe/rtp: Keep track of non-OA nonpriv slots drm/xe/rtp: Maintain OA whitelists separately drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting HID: logitech-dj: Fix maxfield check in DJ short report validation spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX drm/vmwgfx: validate external BO copy bounds for both stride paths drm/vmwgfx: use check_add_overflow for shader size+offset bound drm/vmwgfx: enforce cursor size limits for MOB cursors drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure drm/vmwgfx: bound DMA command body size against suffix pointer drm/vmwgfx: validate DRAW_PRIMITIVES header size before division drm/vmwgfx: drop dma_buf reference on foreign-fd prime import drm/vmwgfx: take fman->lock around fence list mutation in fifo_down drm/vmwgfx: clamp dirty-page range with min, not max drm/vmwgfx: reject DX_BIND_QUERY without a DX context drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size drm/amdkfd: hold event_mutex while checkpointing CRIU events drm/amdkfd: Handle invalid event type in CRIU event restore drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment drm/amdkfd: fix QID bit leak in pqm_create_queue() drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE drm/amd/display: use proper context for logging drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames drm/amd/pm: fix torn gpu metrics reads drm/amdgpu: cap GTT size to physical RAM on APUs drm/amdgpu: restore UMD profile pstate after runtime resume drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini drm/mediatek: ovl_adaptor: balance component registrations drm/panthor: validate firmware interface structure sizes drm/panthor: reject firmware sections with oversized data drm/bridge: display-connector: Fix I2C adapter resource leak drm/vc4: Zero the tile state data array before each BIN job drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs can: ctucanfd: mark error-active controller status valid can: ctucanfd: handle bus error interrupts can: ctucanfd: unmap BAR0 using base address can: ctucanfd: use self-test mode for PRESUME_ACK can: ctucanfd: add missing MODULE_DEVICE_TABLE() can: peak_usb: validate uCAN receive record lengths can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error can: peak_usb: add bounds check for USB channel index can: softing: fw_parse(): validate firmware record spans can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure can: ems_usb: validate CPC message lengths can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured i2c: imx: Cancel hrtimer before clearing slave pointer i2c: imx: Fix slave registration race and error handling i2c: imx: mark I2C adapter when hardware is powered down i2c: iproc: reset bus after timeout if START_BUSY is stuck i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers i2c: spacemit: request IRQ after controller initialization ice: fix memory leak in ice_lbtest_prepare_rings() ice: fix VF interrupts cleanup ice: wait for reset completion in ice_resume() net: openvswitch: fix skb leak on flow key update failure during ct net: openvswitch: fix skb leak on flow key update failure during recirculation net: openvswitch: fix potential UAF on meter attach failure phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB phy: zynqmp: use read-modify-write for SERDES scrambler bypass phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask s390/zcrypt: Validate length for CCA ECC private key requests s390/zcrypt: Validate length for CCA AES cipher key requests s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() s390/zcrypt: Fix buffer over-read in cca_cipher2protkey s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs s390/dasd: Fix undersized format-check buffer s390/dasd: Fix potential NULL pointer dereference s390/qeth: Check CAP_NET_ADMIN for private ioctls s390/pci: Fix s390_pci_mmio_write syscall error return without MIO power: supply: max17040: handle missing status supplier power: supply: bq25890: fix the -10 C NTC lookup entry cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() cifs: add fscache_resize_cookie() to cifs_setsize() gpio: pch: use raw_spinlock_t for the register lock gpio: pca953x: fix cache_only and IRQ state on restore_context() failure i2c: amd-mp2: Unregister callback on adapter add failure hwmon: (pmbus/core) notify on the hwmon device, not the i2c client hwmon: (npcm750-pwm-fan): stop fan timer on device detach sctp: prevent peer transport count overflow sctp: reject stale cookies with mismatched verification tags scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write selftests/clone3: fix wild pointer access of getline due to missing init selftests/mm: fix potential wild pointer access of getline due to missing init spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure spi: spi-qpic-snand: write the feature value before executing SET_FEATURE tracing/filters: Fix false positive match in regex_match_full() tracing: Check return value of __register_event() in trace_module_add_events() ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() vxlan: use pskb_network_may_pull() in route_shortcircuit() vxlan: use pskb_network_may_pull() for transmit path header pulls vxlan: use neigh_ha_snapshot() in route_shortcircuit() vxlan: unclone skb head before modifying eth header in route_shortcircuit() vxlan: re-fetch eth header after route_shortcircuit() veth: convert frag_list skbs before running XDP uprobes: Fix NULL pointer dereference in hprobe_expire() um: vector: fix use-after-free in vector_mmsg_rx() powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() net: pktgen: fix proc entry use-after-free net: ipv6: clear suppressed fib6 rule result net: bridge: stop fast-leave after deleting a port group mm: memcg: initialize *locked in memcg1_oom_prepare() stub mm/page_reporting: use system_freezable_wq to fix UAF during suspend io_uring/net: initialize mshot_len for send binfmt_misc: don't let an 'F' entry pin its own instance binfmt_misc: reject a flag character as the field delimiter binfmt_misc: use exe_file_deny_write_access() for the interpreter clone binfmt_misc: restore write access when removing an entry wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames tipc: avoid use-after-free in poll trace queue dumps of/address: Fix NULL bus dereference in of_pci_range_parser_one() netfilter: ipset: do not update comments from kernel-side hash adds net/smc: fix socket use-after-free during link group termination mshv: fix hv_input_get_system_property struct ksmbd: reject repeated SMB2 NEGOTIATE requests ipvs: do not propagate one-packet flag to synced conns igc: remove napi_synchronize() in igc_down() igbvf: Fix leak in TX DMA error cleanup e1000: fix memory leak in e1000_probe() dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ ALSA: usb-audio: Clamp frame size in implicit-feedback mode ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() ALSA: usb-audio: fix stack info leak in RME Digiface status ALSA: usb-audio: fix use-after-free in ump_to_endpoint() ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-eh: Increase STANDBY IMMEDIATE timeout ASoC: tas2562: fix broken entries in the volume lookup table ASoC: tas2562: fix DVC coefficient write order ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return ALSA: ump: fix double free of out_cvts on rawmidi error ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes ALSA: seq: Fix division by zero in initialize_timer() ALSA: pcm: wake linked drain waiters on unlink ALSA: lx6464es: fix period byte count for 16-bit streams ALSA: hda/realtek: Add quirk for TongFang X6SP45xU ALSA: 6fire: Fix UAF at error handling during probe afs: Fix UAF when sending a message afs: Fix afs_fs_fetch_data() to subtract transferred from len afs: Fix afs_fs_fetch_data() to set call->async bpf: lwt: Fix dst reference leak on reroute failure Bluetooth: HIDP: validate numbered report payloads Bluetooth: HIDP: reject frames without a transaction header Bluetooth: hci_sync: Fix advertising data UAFs Bluetooth: mgmt: fix UAF in pair command cancellation Bluetooth: SCO: give the socket its own sco_conn reference Bluetooth: mgmt: fix pending command UAF in EIR updates Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() audit: fix potential use-after-free in audit_del_rule() audit: fix potential integer overflow in audit_log_n_string() sctp: validate Adaptation Indication parameter length dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister KVM: s390: pci: Validate AIBV and AISB before pinning guest pages KVM: s390: pci: Fix NULL dereference on AIBV allocation failure KVM: s390: pci: Fix missing error codes and memory unaccounting KVM: s390: pci: Fix memory accounting for pinned/unpinned pages KVM: s390: pci: Reject adapter interrupt forwarding if already enabled KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active KVM: VMX: add memory clobber to asm for VMX instructions tracing/fprobe: Roll back on enable_trace_fprobe() failure tracing/probes: Reject $arg0 in meta argument expansion mm/vmstat: fold stranded per-cpu node stats when a node comes online mm/hugetlb: fix list corruption in allocate_file_region_entries() mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes selftest: fix headers in fclog.c mm/util: don't read __page_2 for order-1 folios in snapshot_page() mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE fortify: Disable -Wstringop-overread in tests pinctrl: bm1880: add missing select GENERIC_PINCONF erofs: cap LZMA stream pool size pinctrl: devicetree: don't free uninitialized dev_name on error path pinctrl: microchip-sgpio: add missing select REGMAP_MMIO iommu/iommufd: Fix IOPF group ownership UAF iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds iommufd/viommu: Release the igroup lock on the vdevice_size error path mshv: Order pt_vp_array publish against irqfd assertion path mshv: Fix level-triggered check on uninitialized data mshv: adjust interrupt control structure for ARM64 mshv: Fix race in mshv_irqfd_deassign iomap: add a separate bio_set for iomap_split_ioend ksmbd: fix use-after-free in __close_file_table_ids() ksmbd: return success for deferred final close drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status qede: sync udp_tunnel ports outside qede_lock in the recovery path spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs sched/deadline: Use revised wakeup rule only for running dl_server octeontx2-pf: Set correct sequence for carrier off and tx queue stop net: libwx: fix FDIR ATR queue mismatch for software VLAN packets ptp: netc: fix potential interrupt storm caused by incorrect unbind order net: dsa: mt7530: error out on failed reads in MT7531 PHY polling net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove accel/qaic: use sizeof(*trans_hdr) for transaction length check riscv: drop __init from vec_check_unaligned_access_speed_all_cpus tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions tracing/mmiotrace: Reset dropped_count in mmio_reset_data() fprobe: Fix module reference count leak on error in register_fprobe() drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder can: isotp: check register_netdevice_notifier() error in module init net: sxgbe: check descriptor ring allocation failures net: sxgbe: free TX rings on RX allocation failure scsi: target: Clear cmd_cnt when initial counter enrollment fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command scsi: ufs: core: Cancel RTC work in active-active suspend scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE net: phylink: put link_gpio if phylink_create fails x86/boot: Add volatile, clobbers and zero-length test in memcmp() Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Bluetooth: btintel: Validate length before parsing diagnostics TLV Bluetooth: ISO: fix refcounting of iso_conn Bluetooth: ISO: ensure no dangling hcon references in iso_conn Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Bluetooth: ISO: fix leaking sk after socket release Bluetooth: ISO: hold sk properly in iso_conn_ready Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Bluetooth: ISO: Fix not updating BIS sender source address Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Bluetooth: ISO: lock sk in iso_connect_ind Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Bluetooth: HCI: Add initial support for PAST Bluetooth: ISO: lock sk in iso_sock_getname Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Bluetooth: ISO: clear iso_data always when detaching conn from hcon ice: suppress DPLL errors during reset recovery idpf: Fix mailbox IRQ name leak on request failure idpf: adjust TxQ ring count minimum hwmon: (pmbus) Fix return value from pmbus_update_byte_data() net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller netfs: release readahead folios on iterator preparation failure netfs: handle single writeback rolling buffer allocation failure netfs: clear PG_private_2 on copy-to-cache append failure wifi: mac80211: validate individual TWT params before driver setup net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() powerpc/boot: Fix treeboot-akebono CPU node lookup check powerpc/boot: Fix treeboot-currituck CPU node lookup check powerpc/boot: Fix simpleboot CPU node lookup check rtase: fix double free of multi-frag skb on DMA map failure hwmon: (adt7470) Fix PWM auto temp state array and bounds check hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors forcedeth: fix UAF of txrx_stats in nv_remove net: bridge: mrp: fix Option TLV length in MRP_Test frames hwmon: (nct6775-core) Prevent access to unsupported weight registers net: do not send ICMP/NDISC Redirects when peer allocation fails hwmon: (nzxt-smart2) DMA-align output buffer hwmon: (lm90) Only report alarms if driver is ready hwmon: (sht3x) Fix unaligned accesses hwmon: (ltc4282) Fix reading the minimum alarm voltage hwmon: (ina2xx) Fix various overflow issues hwmon: (ina2xx) Shift INA234 shunt and current registers hwmon: (ina2xx) Add support for INA234 hwmon: (ina2xx) Make it easier to add more devices hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 spi: spi-cadence: Move TX FIFO full busy-wait into FIFO spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 ASoC: tas2781: Use correct calibration data for SINEGAIN2 register smb: client: fix buffer leaks in SMB1 read and write scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer pinctrl-amd: Don't clear S4 wake bits at probe xsk: drain continuation descs after overflow in xsk_build_skb() xsk: use a smaller new lock for shared pool case xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx selftests/net/af_unix: test listen() rejects wrong socket states selftest: af_unix: Create its own .gitignore. selftests: af_unix: Add tests for ECONNRESET and EOF semantics af_unix: fix listen() succeeding on sockets in the wrong state rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled ASoC: SDCA: Ensure that Control Range is large enough for header netfilter: nft_payload: fix mask build for partial field offload ipvs: do not mangle ICMP replies for non-first fragments ipvs: fix places with wrong packet offsets ipvs: fix the checksum validations netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nf_tables: make nft_object rhltable per table assoc_array: trim the final shortcut word using the current chunk end keys: make keyring key-chunk byte order agree with keyring_diff_objects() keys: fix out-of-bounds read in keyring_get_key_chunk() KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type KVM: arm64: Reject guest_memfd memslots when the VM has MTE mshv: Fix sleeping under spinlock in mshv_portid_alloc mshv: Fix duplicate GSI detection for GSI 0 Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Drivers: hv: Allocate the paravisor SynIC pages when required Drivers: hv: Rename fields for SynIC message and event pages arch/x86: mshyperv: Discover Confidential VMBus availability drm/mediatek: Check CRTC state before freeing netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() phy: zynqmp: fix runtime PM leak on probe allocation failure phy: zynqmp: fix clock error handling in xpsgtr_phy_init() btrfs: raid56: fix an incorrect csum skip during scrub btrfs: zoned: reset meta_write_pointer on zone reset btrfs: zoned: fix deadlock between metadata writeback and transaction commit btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag of: reserved_mem: prevent OOB when too many dynamic regions are defined ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup phy: qcom: m31-eusb2: Fix return value of init call ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe selftests/seccomp: Fix pointer type mismatch build error selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 pinctrl: qcom: Unconditionally mark gpio as wakeup enable thunderbolt: Prevent XDomain delayed work use-after-free on disconnect mm/slab: prevent unbounded recursion in free path with new kmalloc type lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: Standardise hid_report_enum variable nomenclature ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 drm/gpusvm: publish dpagemap early to avoid device mapping leak on error net: mpls: initialize rtm_tos in mpls_getroute() netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() kunit: tool: Terminate kernel under test on SIGINT kunit: tool: skip stty when stdin is not a tty netfilter: nf_conntrack_expect: restore helper propagation via expectation Linux 6.18.43 x86/bugs: Make Safe-RET robust against interrupt injection Linux 6.18.42 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug gpu: Fix uninitialized buddy for built-in drivers net: stmmac: fix dwmac4 transmit performance regression net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query usb: gadget: f_tcm: synchronize delayed set_alt with teardown rust: device: avoid trailing ; in printing macros rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 mm/damon/core: disallow overlapping input ranges for damon_set_regions() mm/damon/core: validate ranges in damon_set_regions() i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization i3c: mipi-i3c-hci: Fix Hot-Join NACK pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI pmdomain: imx93-blk-ctrl: convert to devm_* only net: ipa: fix SMEM state handle leaks in SMP2P init ata: libata-core: Reject an invalid concurrent positioning ranges count bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify net: mana: Optimize irq affinity for low vcpu configs net: mana: Validate the packet length reported by the NIC fs/resctrl: Fix use-after-free during unmount fs/resctrl: Move RMID initialization to first mount fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] x86,fs/resctrl: Rename some L3 specific functions x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain fs/resctrl: Split L3 dependent parts out of __mon_event_count() mmc: vub300: fix use-after-free on probe failure mmc: vub300: rename probe error labels dm: avoid leaking the caller's thread keyring via the table device file cred: add kernel_cred() helper accel/amdxdna: reject command submission on devices without a submit op ovl: use linked upper dentry in copy-up tmpfile dmaengine: dw-edma-pcie: Reject devices without driver data dmaengine: dw-edma: Fix confusing cleanup.h syntax mtd: maps: vmu-flash: fix fault in unaligned fixup kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES mm/sparse-vmemmap: fix vmemmap accounting underflow remoteproc: xlnx: Check remote core state cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c cxl/pci: Remove unnecessary CXL RCH handling helper functions cxl/pci: Remove unnecessary CXL Endpoint handling helper functions SUNRPC: Return an error from xdr_buf_to_bvec() on overflow SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists sunrpc: allocate a separate bvec array for socket sends NFSD: pass nfsd_file to nfsd_iter_read() pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP gpu/buddy: bail out of try_harder when alignment cannot be honoured drm: drop lib from header search path. gpu: Move DRM buddy allocator one level up (part two) netfilter: nf_conntrack_sip: validate skb_dst() before accessing it netfilter: nf_conntrack_sip: remove net variable shadowing netfilter: nft_fib: reject fib expression on the netdev egress hook netfilter: nf_tables: remove register tracking infrastructure arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers arm64: dts: qcom: correct RBR opp entry VDUSE: avoid leaking information to userspace vduse: take out allocations from vduse_dev_alloc_coherent vduse: remove unused vaddr parameter of vduse_domain_free_coherent vduse: return internal vq group struct as map token xfs: don't replace the wrong part of the cow fork fuse-uring: fix race between registration and connection abortion audit: fix recursive locking deadlock in audit_dupe_exe() audit: use 'unsigned int' instead of 'unsigned' audit: widen ino fields to u64 landlock: Account all audit data allocations to user space landlock: Fix formatting drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources fscrypt: Avoid dynamic allocation in fscrypt_get_devices() ksmbd: validate ACE size against SID sub-authorities ksmbd: bound DACL dedup walk to copied ACEs ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl net: qrtr: ns: Raise node count limit to 512 ublk: wait on ublk_dev_ready() instead of ub->completion drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR dm-verity: fix buffer overflow in FEC calculation dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS dm-verity-fec: fix reading parity bytes split across blocks (take 3) dm-verity-fec: fix the size of dm_verity_fec_io::erasures bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx drm/amd/pm: fix smu13 power limit range calculation drm/amdgpu: fix aperture mapping leak drm/amdgpu: invoke pm_genpd_remove() before freeing genpd drm/amdgpu: fix resource leak on ACP reset timeout drm/amdgpu: fix division by zero with invalid uvd dimensions drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() drm/amdgpu/vcn4: avoid rereading IB param length drm/amdgpu/vce: fix integer overflow in image size drm/amdgpu/soc24: reset dGPU if suspend got aborted drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx8: drop unecessary BUG_ON() drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() drm/amd/pm: make pp_features read-only when scpm is enabled drm/amd/pm: fix amdgpu_pm_info power display units watchdog: s32g_wdt: remove incorrect options in watchdog_info struct vxlan: mdb: Fix source list corruption on a failed replace vsock/virtio: collapse receive queue under memory pressure tipc: clear sock->sk on the failed-insert path in tipc_sk_create() tcp: challenge ACK for non-exact RST in SYN-RECEIVED tcp: initialize standalone TCP-AO response padding rtase: Workaround for TX hang caused by hardware packet parsing pppoe: reload header pointer after dev_hard_header() ovpn: hold peer before scheduling keepalive work ovpn: fix peer refcount leak in TCP error paths openvswitch: fix GSO userspace truncation underflow mctp: serial: handle zero-length frames to prevent rx buffer overflow mac802154: llsec: reject frames shorter than the authentication tag mac802154: hold an interface reference across the scan worker ila: reload IPv6 header after pskb_may_pull in checksum adjust ice: use READ_ONCE() to access cached PHC time ice: reject out-of-range ptype in ice_parser_profile_init gve: fix Rx queue stall on alloc failure ksmbd: defer destroy_previous_session() until after NTLM authentication smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target rbd: Reset positive result codes to zero in object map update path super: fix emergency thaw deadlock on frozen block devices ice: fix PTP Call Trace during PTP release ptp: ptp_s390: Add missing facility check s390/ptff: Export ptff_function_mask[] proc: Fix broken error paths for namespace links net: pcs: xpcs: fix SGMII state reading net: hip04: fix RX buffer leak on build_skb failure net: gro: fix double aggregation of flush-marked skbs net/x25: fix use-after-free in x25_kill_by_neigh() net/mlx5e: Use sender devcom for MPV master-up net/iucv: fix use-after-free of a severed iucv_path net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() geneve: require CAP_NET_ADMIN in the device netns for changelink net: slip: serialize receive against buffer reallocation vxlan: require CAP_NET_ADMIN in the device netns for changelink phonet: pep: fix use-after-free in pep_get_sb() net: stmmac: intel: skip SerDes reconfig when rate is unchanged iommu/vt-d: Disallow SVA if page walk is not coherent iomap: fix out-of-bounds bitmap_set() with zero-length range io_uring/rw: fix missing ERESTARTSYS conversion in read paths ftrace: Add global mutex to serialize trace_parser access fscrypt: Add missing superblock check in find_or_insert_direct_key() fs: preserve ACL_DONT_CACHE state in forget_cached_acl() fs/super: fix emergency thaw double-unlock of s_umount binfmt_elf_fdpic: only honour the first PT_INTERP ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown amt: fix use-after-free in AMT delayed works libceph: remove debugfs files before client teardown libceph: reject zero bucket types in crush_decode libceph: Reject monmaps advertising zero monitors libceph: refresh auth->authorizer_buf{,_len} after authorizer update libceph: guard missing CRUSH type name lookup libceph: Fix multiplication overflow in decode_new_up_state_weight() libceph: bound get_version reply decode to front len ceph: fix writeback_count leak in write_folio_nounlock() ceph: fix refcount leak in ceph_readdir() ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() sctp: close UDP tunnel sockets during netns teardown sctp: avoid auth_enable sysctl UAF during netns teardown sctp: don't free the ASCONF's own transport in DEL-IP processing mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established mm/kmemleak: fix checksum computation for per-cpu objects afs: Fix afs_edit_dir_remove() to get, not find, block 0 mptcp: pm: userspace: fix use-after-free in get_local_id mptcp: only set DATA_FIN when a mapping is present mptcp: decrement subflows counter on failed passive join Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates arm64: make huge_ptep_get handled unaligned addresses tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing: Fix union collision of module and refcnt for dynamic events tracing: Fix resource leak on mmiotrace trace_pipe close tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix context switch counter truncation misc: nsm: pin the module while the device is open misc: nsm: only unlock nsm_dev on post-lock error paths intel_th: fix MSC output device reference leak mei: bus: access mei_device under device_lock on cleanup selftests: ntsync: correct CONFIG_NTSYNC name serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms serial: sc16is7xx: implement gpio get_direction() callback uio_hv_generic: Bind to FCopy device by default comedi: comedi_parport: deal with premature interrupt x86/boot/compressed: Disable jump tables firmware: stratix10-svc: fix memory leaks and list corruption bugs rhashtable: clear stale iter->p on table restart cdrom: fix stack out-of-bounds read in CDROMVOLCTRL LoongArch: Retrieve CPU package ID from PPTT when available LoongArch: Move jump_label_init() before parse_early_param() LoongArch: Fix oops during single-step debugging LoongArch: Fix address space mismatch in kexec command line lookup objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 rust: allow `clippy::unwrap_or_default` globally rust: time: fix as_micros_ceil() to round correctly for negative Delta rust_binder: only print failure if error has source platform/loongarch: laptop: Explicitly reset bl_powered state when suspend binfmt_misc: set have_execfd only once the interpreter is opened exec: fix unsigned loop counter wrap in transfer_args_to_stack() Bluetooth: RFCOMM: Fix session UAF in set_termios Bluetooth: hci_sync: Protect UUID list traversal staging: rtl8723bs: fix inverted HT40 secondary channel offset staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 wifi: brcmfmac: make release_scratchbuffers idempotent wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses wifi: wilc1000: validate assoc response length before subtracting header wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper wifi: ath6kl: fix use-after-free in aggr_reset_state() wifi: ath6kl: fix OOB access from firmware ADDBA window size ALSA: timer: don't re-enter an instance callback that is still running ALSA: timer: drain a slave's callback before its master detaches it ALSA: hda: codecs: hdmi: disable keep-alive before audio format change ALSA: seq: close a re-opened queue timer in the destructor ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 media: vpif_capture: fix OF node reference imbalance media: vivid: fix cleanup bugs in vivid_init() media: vivid: check for vb2_is_busy() when toggling caps media: vivid: add vivid_update_reduced_fps() media: vimc: fix reference leak on failed device registration media: vidtv: fix reference leak on failed device registration media: verisilicon: Export only needed pixels formats media: vb2: use ssize_t for vb2_read/vb2_write media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() media: v4l2-ctrls: validate HEVC active reference counts media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() media: ti: vpe: unwind v4l2 device registration on probe error media: tegra-video: vi: fix invalid u32 return value in format lookup media: synopsys: hdmirx: Fix HPD lane hold time media: sun4i-csi: Return queued buffers on start_streaming() failure media: stm32: dcmi: unregister notifier on probe failure media: stm32-dcmipp: Return queued buffers on start_streaming() failure media: saa7134: Fix a possible memory leak in saa7134_video_init1 media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used media: rtl2832_sdr: Return queued buffers on start_streaming() failure media: rtl2832: fix use-after-free in rtl2832_remove() media: radio-si476x: Unregister v4l2_device on probe failure media: qcom: camss: Fix RDI streaming for CSID GEN3 media: qcom: camss: Fix RDI streaming for CSID GEN2 media: qcom: camss: Fix RDI streaming for CSID 680 media: pwc: Return queued buffers on start_streaming() failure media: pwc: Drain fill_buf on start_streaming() failure media: pci: dm1105: Free allocated workqueue media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding media: nxp: imx8-isi: Fix potential out-of-bounds issues media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe media: nuvoton: npcm-video: fix memory leaks in probe and remove media: nuvoton: npcm-video: fix error handling in npcm_video_init() media: msi2500: Return queued buffers on start_streaming() failure media: meson: vdec: Fix memory leak in error path of vdec_open media: marvell-cam: fix missing pci_disable_device() on remove media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges media: imx219: Fix maximum frame length in lines media: i2c: alvium: fix critical pointer access in alvium_ctrl_init media: cx23885: add ioremap return check and cleanup media: cx231xx: fix devres lifetime media: chips-media: wave5: Move src_buf Removal to finish_encode media: cedrus: skip invalid H.264 reference list entries media: cedrus: Fix missing cleanup in error path media: cedrus: clean up media device on probe failure media: cec: seco: unregister adapter on IR probe failure media: aspeed: fix missing of_reserved_mem_device_release() on probe failure media: amlogic-c3: Add validations for ae and awb config media: airspy: Return queued buffers on start_streaming() failure drm/v3d: Reach the GMP through the hub registers on V3D 7.x drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict drm/vc4: Prevent shader BO mappings from becoming writable drm/vmwgfx: Validate vmw_surface_metadata::array_size drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() drm/vc4: Shut down BO cache timer before teardown drm/amd/display: Fix flip-done timeouts on mode1 reset drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge drm/amd/display: Fix backlight max_brightness to match exported range drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 drm/amd/display: dce100: skip non-DP stream encoders for DP MST drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock drm/amd/display: set new_stream to NULL after release drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amdgpu: Fix VFCT bus number matching with soft filter drm/amdgpu: Release VFCT ACPI table reference drm/panthor: return error on truncated firmware drm/ttm: Account for NULL and handle pages in ttm_pool_backup drm/virtio: Don't detach GEM from a non-created context drm/gfx10: Program DB_RING_CONTROL drm/amd/pm: fix smu14 power limit range calculation drm/i915/mst: limit DP MST ESI service loop drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU drm/i915/gem: Do not leak siblings[] on proto context error drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled drm/i915/bios: range check LFP Data Block panel_type2 drm/i915: Return NULL on error in active_instance drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() drm/i915/hdcp: check streams[] bounds before overflow drm/i915/hdcp: require monotonically increasing seq_num_v drm/virtio: bound EDID block reads to the response buffer drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips drm/amdkfd: fix 32-bit overflow in CWSR total size calculation drm/amdkfd: Check bounds on CRIU restore queue type and mqd size drm/amdkfd: Check bounds in allocate_event_notification_slot drm/amdkfd: Use kvcalloc to allocate arrays drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM drm/imagination: fix error checking of pvr_vm_context_lookup() drm/imagination: Fix user array stride in pvr_set_uobj_array() drm/imagination: Fix double call to drm_sched_entity_fini() drm/xe: Hold a dma-buf reference for imported BOs drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds drm/xe: Return error on non-migratable faults requiring devmem drm/radeon: fix r100_copy_blit for large BOs drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() drm/i915/gem: Add missing nospec on parallel submit slot drm/displayid: fix Tiled Display Topology ID size drm/sysfb: Return errno code from drm_sysfb_get_visible_size() drm/sysfb: Avoid possible truncation with calculating visible size drm/nouveau: fix reversed error cleanup order in ucopy functions drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 drm/sysfb: Avoid truncating maximum stride drm/sysfb: Do not page-align visible size of the framebuffer drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) drm/amdgpu/gfx: fix cleaner shader IB buffer overflow drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers drm/imagination: Fit paired fragment job in the correct CCCB drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() drm/imagination: Count paired job fence as dependency in prepare_job() drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() drm/tidss: Fix missing drm_bridge_add() call drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() mctp: check register_netdevice_notifier() error in mctp_device_init() ptp: netc: explicitly clear TMR_OFF during initialization rds: tcp: unregister sysctl before tearing down listen socket ipv6: Change allocation flags to match rcu_read_lock section requirements ice: prevent tstamp ring allocation for non-PF VSI types ice: fix LAG recipe to profile association ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV net: ipv6: fix dif and sdif mismatch in raw6_icmp_error octeontx2-pf: tc: fix egress ratelimiting net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation net/mlx5e: Report zero bandwidth for non-ETS traffic classes net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule net/mlx5: Fix MCIA register buffer overflow on 32 dword reads net/mlx5: Refactor EEPROM query error handling to return status separately raw: annotate lockless match fields in raw_v4_match() net: qrtr: restrict socket creation to the initial network namespace hinic: remove unused ethtool RSS user configuration buffers ppp: annotate data races in ppp_generic ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup octeontx2-vf: set TC flower flag on MCAM entry allocation net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM net: stmmac: enable the MAC on link up for all supported speeds net: stmmac: reset residual action in L3L4 filters on delete net: stmmac: fix l3l4 filter rejecting unsupported offload requests net: stmmac: xgmac: fix l4 filter port overwrite on register update net: stmmac: cores: remove many xxx_SHIFT definitions net: stmmac: socfpga: Add hardware supported cross-timestamp net: stmmac: socfpga: Enable TBS support for Agilex5 net: stmmac: socfpga: Agilex5 EMAC platform configuration net: stmmac: remove xstats.pcs_* members bpf: tcp: fix double sock release on batch realloc drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem tipc: fix u16 MTU truncation in media and bearer MTU validation iomap: correct the range of a partial dirty clear drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() drm/xe/i2c: Allow per domain unique id vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets sctp: auth: verify auth requirement when auth_chunk is NULL net: dpaa: fix mode setting net: hsr: fix memory leak on slave unregistration by removing synced VLANs net: bridge: vlan: fix vlan range dumps starting with pvid amt: make the head writable before rewriting the L2 header amt: re-read skb header pointers after every pull ovl: check access to copy_file_range source with src mounter creds ovl: port ovl_copyfile() to cred guard ovl: add override_creds cleanup guard extension for overlayfs cred: add scoped_with_kernel_creds() drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER ovl: fix trusted xattr escape prefix matching wifi: brcmfmac: fix 802.1X-SHA256 call trace warning wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() wifi: mt76: mt7925: fix crash in reset link replay wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() wifi: mt76: mt7915: guard HE capability lookups wifi: mt76: mt7925: guard link STA in decap offload ppp: annotate concurrent dev->stats accesses ppp: don't store tx skb in the fastpath ppp: enable TX scatter-gather tipc: fix infinite loop in __tipc_nl_compat_dumpit nexthop: initialize extack in nh_res_bucket_migrate() gtp: check skb_pull_data() return in gtp1u_send_echo_resp() selftests: drv-net: increase timeout selftests: ovpn: increase timeout selftests: ovpn: add IPV6 and VETH configs selftests: openvswitch: add config file selftests: af_unix: add USER_NS config tls: device: push pending open record on splice EOF net: mctp i3c: clean up notifier and buses if driver register fails sctp: validate stream count in sctp_process_strreset_inreq() pds_core: check for workqueue allocation failure pds_core: fix auxiliary device add/del races pds_core: order completion reads after the ownership check pds_core: yield the CPU while waiting for the adminq to drain pds_core: fix use-after-free on workqueue during remove pds_core: fix deadlock between reset thread and remove sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid net: txgbe: fix FDIR filter leak on remove net: Call net_enable_timestamp() before failure in sk_clone(). soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() pds_core: reject component parameter in legacy firmware update wifi: mac80211: recalculate TIM when a station enters power save iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() iommu/amd: Bound the early ACPI HID map wifi: mwifiex: bound uAP association event IEs to the event buffer vhost-net: fix TX stall when vhost owns virtio-net header wan: wanxl: Only reset hardware after BAR mapping nfp: Check resource mutex allocation wifi: mac80211: tear down new links on vif update error path iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() net: airoha: Fix DMA direction for NPU mailbox buffer dpaa2-eth: put MAC endpoint device on disconnect net: airoha: Fix potential use-after-free in airoha_ppe_deinit() dpaa2-switch: put MAC endpoint device on disconnect rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() gtp: parse extension headers before reading inner protocol rds: drop incoming messages that cross network namespace boundaries bonding: fix devconf_all NULL dereference when IPv6 is disabled net/packet: avoid fanout hook re-registration after unregister netlink: specs: rt-link: convert bridge port flag attributes to u8 net: phy: marvell: fix return code Bluetooth: btusb: validate Realtek vendor event length regulator: mt6358: use regmap helper to read fixed LDO calibration hwmon: occ: validate poll response sensor blocks ovpn: use monotonic clock for peer keepalive timeouts ovpn: fix use after free in unlock_ovpn() selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote() ovpn: avoid putting unrelated P2P peer on socket release smb: client: validate DFS referral PathConsumed hwmon: (asus-ec-sensors) add missed handle for ENOMEM hwmon: (asus-ec-sensors) fix EC read intervals hwmon: (asus-ec-sensors) fix looping over banks while reading from EC drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect wifi: iwlwifi: mvm: fix read in wake packet notification handler wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list wifi: iwlwifi: mvm: validate SAR GEO response payload size ASoC: cs35l56: Use complete_all() to signal init_completion ASoC: cs35l56: Fix potential probe() deadlock ASoC: cs35l56: Don't use devres to unregister component ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI ALSA: hda: cs35l41: validate and free ACPI mute object ASoC: sun4i-codec: Set quirks.playback_only for H616 codec ASoC: tas2781: bound firmware description string parsing btrfs: free mapping node on duplicate reloc root insert btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 wifi: carl9170: fix buffer overflow in rx_stream failover path wifi: carl9170: fix OOB read from off-by-two in TX status handler wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read wifi: ath6kl: fix OOB read from firmware IE lengths in connect event wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler firewire: net: Fix fragmented datagram reassembly wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() watchdog: airoha: Prevent division by zero when clock frequency is zero watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request selftests/bpf: Keep verifier_map_ptr exercising ops pointer access selftests/bpf: Adjust verifier_map_ptr for the map's excl field usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Revert "drm/amd/display: Add missing kdoc for ALLM parameters" RISC-V: KVM: Serialize virtual interrupt pending state updates wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware USB: serial: option: add TDTECH MT5710-CN USB: serial: keyspan_pda: fix data loss on receive throttling USB: serial: io_edgeport: cap received transmit credits USB: serial: ftdi_sio: add support for E+H FXA291 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() USB: gadget: fsl-udc: fix dev_printk() device USB: gadget: fsl-udc: fix device name leak on probe failure USB: gadget: snps-udc: fix device name leak on probe failure usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative USB: storage: add NO_ATA_1X quirk for Longmai USB Key usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() usb: core: sysfs: add lock to bos_descriptors_read() mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure accel/amdxdna: Fix use-after-free of mm_struct in job scheduler drm/i915/selftests: Fix GT PM sort comparators drm/i915/wm: clear the plane ddb_y entries on plane disable ksmbd: validate compound request size before reading StructureSize2 ksmbd: pin conn during async oplock break notification drm/xe/wopcm: fix WOPCM size for LNL+ drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves drm/xe/vf: Shadow buffer management for CCS read/write operations drm/xe/sa: Shadow buffer support in the sub-allocator pool drm/xe: Allow the caller to pass guc_buf_cache size can: j1939: fix lockless local-destination check riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() s390/checksum: Fix csum_partial() without vector facility drm/panthor: Check debugfs GEM lock initialization bpf, sockmap: Reject unhashed UDP sockets on sockmap update powerpc/vtime: Initialize starttime at boot for native accounting powerpc/time: Prepare to stop elapsing in dynticks-idle powerpc/85xx: Add fsl,ifc to common device ids can: raw: add locking for raw flags bitfield drm/i915/gt: use correct selftest config symbol smb/client: handle overlapping allocated ranges in fallocate Bluetooth: hci_qca: Clear memdump state on invalid dump size Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Bluetooth: hci_sync: extend conn_hash lookup critical sections Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update Bluetooth: qca: fix NVM tag length underflow in TLV parser ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC accel/ivpu: Fix wrong register read in LNL failure diagnostics ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts ata: sata_dwc_460ex: use platform_get_irq() ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered scsi: core: wake eh reliably when using scsi_schedule_eh udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() net/iucv: take a reference on the socket found in afiucv_hs_rcv() ipv4: fib: free fib_alias with kfree_rcu() on insert error path ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup ASoC: cs42l43: Correct report for forced microphone jack ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() ASoC: amd: ps: disable MSI on resume in ACP PCI driver ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() wifi: cfg80211: bound element ID read when checking non-inheritance wifi: brcmfmac: initialize SDIO data work before cleanup wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: mac80211: avoid non-S1G AID fallback for S1G assoc wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: validate PMSR measurement type data wifi: nl80211: constrain MBSSID TX link ID range wifi: nl80211: validate nested MBSSID IE blobs wifi: cfg80211: derive S1G beacon TSF from S1G fields wifi: nl80211: free RNR data on MBSSID mismatch wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock wifi: p54: validate RX frame length in p54_rx_eeprom_readback() wifi: mac80211: defer link RX stats percpu free to RCU wifi: libertas: fix memory leak in helper_firmware_cb() wifi: mac80211: fix fils_discovery double free on alloc failure wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure wifi: mac80211_hwsim: clamp virtio RX length before skb_put wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() wifi: cfg80211: cancel sched scan results work on unregister xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() xfrm: clear mode callbacks after failed mode setup RDMA/irdma: Prevent overflows in memory contiguity checks selftests/alsa: Fix memory leak in find_controls error path mtd: fix double free and WARN_ON in add_mtd_device() error paths RDMA/siw: publish QP after initialization RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/mana_ib: initialize err for empty send WR lists RDMA/erdma: initialize ret for empty receive WR lists RDMA/irdma: Prevent user-triggered null deref on QP create RDMA/irdma: Remove redundant legacy_mode checks RDMA/irdma: Prevent rereg_mr for non-mem regions RDMA/umem: Add pinned revocable dmabuf import interface RDMA/cma: Fix hardware address comparison length in netevent callback xfrm: reject optional IPTFS templates in outbound policies sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() btrfs: fallback to transaction csum tree on a commit root csum miss btrfs: use bool type for btrfs_path members used as booleans btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() btrfs: reject free space cache with more entries than pages mtd: nand: mtk-ecc: stop on ECC idle timeouts mtd: mtdswap: remove debugfs stats file on teardown IB/mad: Drop unmatched RMPP responses before reassembly firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits xfrm: fix stale skb->prev after async crypto steals a GSO segment xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() net: plumb drop reasons to __dev_queue_xmit() net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 arm64: tegra: Remove fallback compatible for GPCDMA fuse: fix writeback array overflow when max_pages is one Input: ims-pcu - fix logic error in packet reset Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() xprtrdma: Clear receive-side ownership pointers on release crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings dmaengine: sh: rz-dmac: Move interrupt request after everything is set up can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: fix CAN frame rx/tx statistics can: bcm: add locking when updating filter and timer values KVM: x86/mmu: Fix use-after-free on vendor module reload KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN KVM: x86: Check for invalid/obsolete root *after* making MMU pages available seqlock: Allow UBSAN_ALIGNMENT to fail optimizing seqlock: Allow KASAN to fail optimizing seqlock: Cure some more scoped_seqlock() optimization fails fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race drm/virtio: fix deadlock in display_info_cb by remov…

qswat-orbit-external · 2026-08-18T07:16:03Z

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

qswat-orbit-external · 2026-08-18T07:18:01Z

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

qswat-orbit-external · 2026-08-18T07:20:03Z

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

qswat-orbit-external · 2026-08-18T07:21:22Z

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

Gabriele Monaco (glemco) and others added 30 commits August 9, 2026 20:25

Leo Li (leo-sunli1) and others added 22 commits August 9, 2026 20:25

nsiddams (nsiddams) requested review from a team, Tingwei Zhang (quic-tingweiz), Rajendra (rrnayak) and Shiraz Hashim (shashim-quic) August 18, 2026 07:15

Navigation Menu

Uh oh!

Merge tag 'v6.18.44' into qcom-6.18.y - #970

Merge tag 'v6.18.44' into qcom-6.18.y#970
nsiddams (nsiddams) wants to merge 3298 commits into
qualcomm-linux:qcom-6.18.yfrom
nsiddams:6.18.44-lts

nsiddams (nsiddams) commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Uh oh!

Conversation

nsiddams (nsiddams) commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

qswat-orbit-external Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants