Changelog
linux (6.1.94-1) bookworm; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.91
- [arm64,armhf] dmaengine: pl330: issue_pending waits until WFP state
- dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
- wifi: nl80211: don't free NULL coalescing rule
- eeprom: at24: Use dev_err_probe for nvmem register failure
- eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
- eeprom: at24: fix memory corruption race condition (CVE-2024-35848)
- Bluetooth: qca: add support for QCA2066
- mm/hugetlb: add folio support to hugetlb specific flag macros
- mm: add private field of first tail to struct page and struct folio
- mm/hugetlb: add hugetlb_folio_subpool() helpers
- mm/hugetlb: add folio_hstate()
- mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios
- mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios
- mm/hugetlb: convert free_huge_page to folios
- mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios
- mm/hugetlb: fix missing hugetlb_lock for resv uncharge
- kbuild: refactor host*_flags
- kbuild: specify output names separately for each emission type from rustc
- cifs: use the least loaded channel for sending requests
- smb3: missing lock when picking channel
- [armhf] pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of
GPIOR-T
- [arm64] pinctrl/meson: fix typo in PDM's pin name
- pinctrl: core: delete incorrect free in pinctrl_enable()
- sunrpc: add a struct rpc_stats arg to rpc_create_args
- nfs: expose /proc/net/sunrpc/nfs in net namespaces
- nfs: make the rpc_stat per net namespace
- nfs: Handle error of rpc_proc_register() in nfs_net_init().
- pinctrl: Introduce struct pinfunction and PINCTRL_PINFUNCTION() macro
- [x86] pinctrl: intel: Make use of struct pinfunction and
PINCTRL_PINFUNCTION()
- [x86] pinctrl: baytrail: Fix selecting gpio pinctrl state
- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
- regulator: change stubbed devm_regulator_get_enable to return Ok
- regulator: change devm_regulator_get_enable_optional() stub to return Ok
- bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
- bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
- nvme: fix warn output about shared namespaces without
CONFIG_NVME_MULTIPATH
- bpf: Fix a verifier verbose message
- spi: introduce new helpers with using modern naming
- [arm64] bpf, arm64: Fix incorrect runtime stats
- [s390x] mm: Fix storage key clearing for guest huge pages
- [s390x] mm: Fix clearing storage keys for huge pages
- xdp: use flags field to disambiguate broadcast redirect
- bna: ensure the copied buf is NUL terminated
- nsh: Restore skb->{protocol,data,mac_header} for outer header in
nsh_gso_segment().
- net l2tp: drop flow hash on forward
- [s390x] vdso: Add CFI for RA register to asm macro vdso_func
- net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
- net: qede: use return from qede_parse_flow_attr() for flower
- net: qede: use return from qede_parse_flow_attr() for flow_spec
- net: qede: use return from qede_parse_actions()
- [arm64] ASoC: meson: axg-fifo: use FIELD helpers
- [arm64] ASoC: meson: axg-fifo: use threaded irq to check periods
- [arm64] ASoC: meson: axg-card: make links nonatomic
- [arm64] ASoC: meson: axg-tdm-interface: manage formatters in trigger
- [arm64] ASoC: meson: cards: select SND_DYNAMIC_MINORS
- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
- [s390x] cio: Ensure the copied buf is NUL terminated
- cxgb4: Properly lock TX queue for the selftest.
- [arm64,armhf] net: dsa: mv88e6xxx: Fix number of databases for 88E6141 /
88E6341
- spi: fix null pointer dereference within spi_sync
- net: bridge: fix multicast-to-unicast with fraglist GSO
- net: core: reject skb_copy(_expand) for fraglist GSO skbs
- vxlan: Pull inner IP header in vxlan_rcv().
- [s390x] qeth: Fix kernel panic after setting hsuid
- net: gro: add flush check in udp_gro_receive_segment
- [arm64] clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
- [powerpc*] pseries: replace kmalloc with kzalloc in PLPKS driver
- [powerpc*] pseries: Move PLPKS constants to header file
- [powerpc*] pseries: make max polling consistent for longer H_CALLs
- [powerpc*] pseries/iommu: LPAR panics during boot up with a frozen PE
- [arm64] KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
- [arm64] KVM: arm64: vgic-v2: Check for non-NULL vCPU in
vgic_v2_parse_attr()
- scsi: lpfc: Move NPIV's transport unregistration to after resource clean
up
- scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
- scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
- scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
- gfs2: Fix invalid metadata access in punch_hole
- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
- wifi: cfg80211: fix rdev_dump_mpp() arguments order
- net: mark racy access on sk->sk_rcvbuf
- scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
- scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
- btrfs: return accurate error code on open failure in open_fs_devices()
- bpf: Check bloom filter map value size
- kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
- scsi: ufs: core: WLUN suspend dev/link state error recovery
- ALSA: line6: Zero-initialize message buffers
- block: fix overflow in blk_ioctl_discard()
- net: bcmgenet: Reset RBUF on first open
- ata: sata_gemini: Check clk_enable() result
- firewire: ohci: mask bus reset interrupts between ISR and bottom half
- tools/power turbostat: Fix added raw MSR output
- tools/power turbostat: Increase the limit for fd opened
- tools/power turbostat: Fix Bzy_MHz documentation typo
- btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
- btrfs: always clear PERTRANS metadata during commit
- scsi: target: Fix SELinux error when systemd-modules loads the target
module
- blk-iocost: avoid out of bounds shift
- [arm64,armhf] gpu: host1x: Do not setup DMA for virtual devices
- [mips*] scall: Save thread_info.syscall unconditionally on entry
(Closes: #1068365)
- tools/power/turbostat: Fix uncore frequency file string
- drm/amdgpu: Refine IB schedule error logging
- Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
- [x86] uio_hv_generic: Don't free decrypted memory
- Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
- fs/9p: only translate RWX permissions for plain 9P2000
- fs/9p: translate O_TRUNC into OTRUNC
- 9p: explicitly deny setlease attempts
- gpio: wcove: Use -ENOTSUPP consistently
- gpio: crystalcove: Use -ENOTSUPP consistently
- clk: Don't hold prepare_lock when calling kref_put()
- fs/9p: drop inodes immediately on non-.L too
- drm/nouveau/dp: Don't probe eDP ports twice harder
- net:usb:qmi_wwan: support Rolling modules
- kbuild: rust: avoid creating temporary files
- spi: Merge spi_controller.{slave,target}_abort()
- perf unwind-libunwind: Fix base address for .eh_frame
- perf unwind-libdw: Handle JIT-generated DSOs properly
- qibfs: fix dentry leak
- xfrm: Preserve vlan tags for transport mode software GRO
- tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
(CVE-2024-27398)
- Bluetooth: msft: fix slab-use-after-free in msft_do_close()
- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
(CVE-2024-27399)
- net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
- rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
- [x86] hwmon: (corsair-cpro) Use a separate buffer for sending commands
- [x86] hwmon: (corsair-cpro) Use complete_all() instead of complete() in
ccp_raw_event()
- [x86] hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
- phonet: fix rtm_phonet_notify() skb allocation
- net: bridge: fix corrupted ethernet header on multicast-to-unicast
- ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
- timers: Get rid of del_singleshot_timer_sync()
- timers: Rename del_timer() to timer_delete()
- net-sysfs: convert dev->operstate reads to lockless ones
- hsr: Simplify code for announcing HSR nodes timer setup
- ipv6: annotate data-races around cnf.disable_ipv6
- ipv6: prevent NULL dereference in ip6_output()
- net/smc: fix neighbour and rtable leak in smc_ib_find_route()
- [arm64] net: hns3: using user configure after hardware reset
- [arm64] net: hns3: direct return when receive a unknown mailbox message
- [arm64] net: hns3: change type of numa_node_mask as nodemask_t
- [arm64] net: hns3: release PTP resources if pf initialization failed
- [arm64] net: hns3: use appropriate barrier function after setting a bit
value
- [arm64] net: hns3: fix port vlan filter not disabled issue
- [arm64] net: hns3: fix kernel crash when devlink reload during
initialization
- [arm64] drm/meson: dw-hdmi: power up phy on device init
- [arm64] drm/meson: dw-hdmi: add bandgap setting for g12
- drm/connector: Add \n to message about demoting connector force-probes
- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11
users
- gpiolib: cdev: Add missing header(s)
- gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
- gpiolib: cdev: fix uninitialised kfifo
- drm/amd/display: Atom Integrated System Info v2_2 for DCN35
- MAINTAINERS: add leah to 6.1 MAINTAINERS file
- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
- btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
- firewire: nosy: ensure user_length is taken into account when fetching
packet contents (CVE-2024-27401)
- Reapply "drm/qxl: simplify qxl_fence_wait"
- btf, scripts: rust: drop is_rust_module.sh
- usb: typec: ucsi: Check for notifications after init
- usb: typec: ucsi: Fix connector check on init
- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed
device
- usb: ohci: Prevent missed ohci interrupts
- USB: core: Fix access violation during port device removal
- usb: gadget: composite: fix OS descriptors w_value logic
- usb: gadget: f_fs: Fix a race condition when processing setup packets.
- usb: xhci-plat: Don't include xhci.h
- usb: dwc3: core: Prevent phy suspend during init
- usb: typec: tcpm: unregister existing source caps before re-registration
- usb: typec: tcpm: Check for port partner validity before consuming it
- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
- mm/slab: make __free(kfree) accept error pointers
- mptcp: ensure snd_nxt is properly initialized on connect
- dt-bindings: iio: health: maxim,max30102: fix compatible check
- iio:imu: adis16475: Fix sync mode setting
- iio: accel: mxc4005: Interrupt handling fixes
- [armhf] ASoC: ti: davinci-mcasp: Fix race condition during probe
- dyndbg: fix old BUG_ON in >control parser
- slimbus: qcom-ngd-ctrl: Add timeout for wait operation
- mei: me: add lunar lake point M DID
- drm/vmwgfx: Fix invalid reads in fence signaled events
- [x86] drm/i915/bios: Fix parsing backlight BDB data
- drm/amd/display: Handle Y carry-over in VCP X.Y calculation
- net: fix out-of-bounds access in ops_init
- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
- mm: use memalloc_nofs_save() in page_cache_ra_order()
- regulator: core: fix debugfs creation regression
- spi: microchip-core-qspi: fix setting spi bus clock rate
- ksmbd: off ipv6only for both ipv4/ipv6 binding
- ksmbd: avoid to send duplicate lease break notifications
- ksmbd: do not grant v2 lease if parent lease key and epoch are not set
- Bluetooth: qca: add missing firmware sanity checks
- Bluetooth: qca: fix NVM configuration parsing
- Bluetooth: qca: fix info leak when fetching board id
- Bluetooth: qca: fix info leak when fetching fw build id
- Bluetooth: qca: fix firmware check error path
- VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (CVE-2024-21823)
- dmaengine: idxd: add a new security check to deal with a hardware erratum
(CVE-2024-21823)
- dmaengine: idxd: add a write() method for applications to submit work
(CVE-2024-21823)
- keys: Fix overwrite of key expiration on instantiation
- btrfs: do not wait for short bulk allocation
- mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
- mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
- md: fix kmemleak of rdev->serial (CVE-2024-26900)
- net: bcmgenet: Clear RGMII_LINK upon link down
- net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
- net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
- net: bcmgenet: synchronize UMAC_CMD access
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.92
- drm/amd/display: Fix division by zero in setup_dsc_config
- net: ks8851: Fix another TX stall caused by wrong ISR flag handling
- ice: pass VSI pointer into ice_vc_isvalid_q_id
- ice: remove unnecessary duplicate checks for VF VSI ID
- pinctrl: core: handle radix_tree_insert() errors in
pinctrl_register_one_pin()
- mfd: stpmic1: Fix swapped mask/unmask in irq chip
- nfsd: don't allow nfsd threads to be signalled.
- KEYS: trusted: Fix memory leak in tpm2_key_encode()
- mmc: core: Add HS400 tuning in HS400es initialization
- xfs: write page faults in iomap are not buffered writes
- xfs: punching delalloc extents on write failure is racy
- xfs: use byte ranges for write cleanup ranges
- xfs,iomap: move delalloc punching to iomap
- iomap: buffered write failure should not truncate the page cache
- xfs: xfs_bmap_punch_delalloc_range() should take a byte range
- iomap: write iomap validity checks
- xfs: use iomap_valid method to detect stale cached iomaps
- xfs: drop write error injection is unfixable, remove it
- xfs: fix off-by-one-block in xfs_discard_folio()
- xfs: fix incorrect error-out in xfs_remove
- xfs: fix sb write verify for lazysbcount
- xfs: fix incorrect i_nlink caused by inode racing
- xfs: invalidate block device page cache during unmount
- xfs: attach dquots to inode before reading data/cow fork mappings
- xfs: wait iclog complete before tearing down AIL
- xfs: fix super block buf log item UAF during force shutdown
- xfs: hoist refcount record merge predicates
- xfs: estimate post-merge refcounts correctly
- xfs: invalidate xfs_bufs when allocating cow extents
- xfs: allow inode inactivation during a ro mount log recovery
- xfs: fix log recovery when unknown rocompat bits are set
- xfs: get root inode correctly at bulkstat
- xfs: short circuit xfs_growfs_data_private() if delta is zero
- [arm64] atomics: lse: remove stale dependency on JUMP_LABEL
- drm/amdgpu: Fix possible NULL dereference in
amdgpu_ras_query_error_status_helper() (CVE-2023-52585)
- [arm*] binder: fix max_thread type inconsistency
- [arm64,armhf] usb: dwc3: Wait unconditionally after issuing EndXfer
command
- net: usb: ax88179_178a: fix link status when link is set to down/up
- usb: typec: ucsi: displayport: Fix potential deadlock
- usb: typec: tipd: fix event checking for tps6598x
- serial: kgdboc: Fix NMI-safety problems from keyboard reset code
- KEYS: trusted: Do not use WARN when encode fails
- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
- docs: kernel_include.py: Cope with docutils 0.21
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.93
- SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
- [x86] tsc: Trust initial offset in architectural TSC-adjust MSRs
- ftrace: Fix possible use-after-free issue in ftrace_location()
- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
- tty: n_gsm: fix missing receive state reset after mode switch
- speakup: Fix sizeof() vs ARRAY_SIZE() bug
- serial: 8250_bcm7271: use default_mux_rate if possible
- serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
- io_uring: fail NOP if non-zero op flags is passed in
- Revert "r8169: don't try to disable interrupts if NAPI is, scheduled
already"
- r8169: Fix possible ring buffer corruption on fragmented Tx packets.
- ring-buffer: Fix a race between readers and resize checks
- net: smc91x: Fix m68k kernel compilation for ColdFire CPU
- nilfs2: fix unexpected freezing of nilfs_segctor_sync()
- nilfs2: fix potential hang in nilfs_detach_log_writer()
- ksmbd: avoid to send duplicate oplock break notifications
- ksmbd: ignore trailing slashes in share paths
- ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460
G11.
- ALSA: core: Fix NULL module pointer assignment at card init
- ALSA: Fix deadlocks with kctl removals at disconnection
- KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST
- wifi: mac80211: don't use rate mask for scanning
- wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon
timestamp field
- wifi: cfg80211: fix the order of arguments for trace events of the
tx_rx_evt class
- dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node
- net: usb: qmi_wwan: add Telit FN920C04 compositions
- drm/amd/display: Set color_mgmt_changed to true on unsuspend
- drm/amdgpu: Update BO eviction priorities
- drm/amdgpu: Fix the ring buffer size for queue VM flush
- drm/amdgpu/mes: fix use-after-free issue
- sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU
- [x86] ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM
too
- regulator: irq_helpers: duplicate IRQ name
- ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
- ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
- regulator: vqmmc-ipq4019: fix module autoloading
- ASoC: rt715: add vendor clear control register
- ASoC: rt715-sdca: volume step modification
- [x86] efistub: Omit physical KASLR when memory reservations exist
- efi: libstub: only free priv.runtime_map when allocated
- [x86] KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in
CPUID
- genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
- fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
- softirq: Fix suspicious RCU usage in __do_softirq()
- ASoC: da7219-aad: fix usage of device_get_named_child_node()
- ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection
- drm/amd/display: Add dtbclk access to dcn315
- drm/amd/display: Add VCO speed parameter for DCN31 FPU
- drm/amdkfd: Flush the process wq before creating a kfd_process
- [x86] mm: Remove broken vsyscall emulation code from the page fault code
- nvme: find numa distance only if controller has valid numa id
- nvmet-auth: return the error code to the nvmet_auth_host_hash() callers
- nvmet-auth: replace pr_debug() with pr_err() to report an error.
- nvmet-tcp: fix possible memory leak when tearing down a controller
- nvmet: fix nvme status code when namespace is disabled
- epoll: be better about file lifetimes
- nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
- openpromfs: finish conversion to the new mount API
- crypto: bcm - Fix pointer arithmetic
- mm/slub, kunit: Use inverted data to corrupt kmem cache
- firmware: raspberrypi: Use correct device for DMA mappings
- ecryptfs: Fix buffer size for tag 66 packet
- nilfs2: fix out-of-range warning
- [x86] crypto: ccp - drop platform ifdef checks
- [amd64] crypto: x86/nh-avx2 - add missing vzeroupper
- [amd64] crypto: x86/sha256-avx2 - add missing vzeroupper
- [amd64] crypto: x86/sha512-avx2 - add missing vzeroupper
- [s390x] cio: fix tracepoint subchannel type field
- io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of
task_work
- io_uring: use the right type for work_llist empty check
- rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
- rcu: Fix buffer overflow in print_cpu_stall_info()
- jffs2: prevent xattr node from overflowing the eraseblock
- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE
- null_blk: Fix missing mutex_destroy() at module removal
- md: fix resync softlockup when bitmap size is less than array size
- block: open code __blk_account_io_start()
- block: open code __blk_account_io_done()
- block: support to account io_ticks precisely
- wifi: ath10k: poll service ready message before failing
- wifi: brcmfmac: pcie: handle randbuf allocation failure
- wifi: ath11k: don't force enable power save on non-running vdevs
- bpftool: Fix missing pids during link show
- [x86] boot: Ignore relocations in .notes sections in walk_relocs() too
- sched/fair: Add EAS checks before updating root_domain::overutilized
- ACPI: Fix Generic Initiator Affinity _OSC bit
- qed: avoid truncating work queue length
- net/mlx5e: Fail with messages when params are not valid for XSK
- mlx5: stop warning for 64KB pages
- bitops: add missing prototype check
- wifi: carl9170: re-fix fortified-memset warning
- bpf: Pack struct bpf_fib_lookup
- scsi: ufs: qcom: Perform read back after writing reset bit
- scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US
- scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0
- scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5
- scsi: ufs: qcom: Perform read back after writing unipro mode
- scsi: ufs: qcom: Perform read back after writing CGC enable
- scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
- scsi: ufs: core: Perform read back after disabling interrupts
- scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
- ACPI: LPSS: Advertise number of chip selects via property
- irqchip/alpine-msi: Fix off-by-one in allocation error path
- irqchip/loongson-pch-msi: Fix off-by-one on allocation error path
- ACPI: disable -Wstringop-truncation
- gfs2: Don't forget to complete delayed withdraw
- gfs2: Fix "ignore unlock failures after withdraw"
- [x86] boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57
- cpufreq: exit() callback is optional
- [x86] pat: Introduce lookup_address_in_pgd_attr()
- [x86] pat: Restructure _lookup_address_cpa()
- [x86] pat: Fix W^X violation false-positives when running as Xen PV guest
- net: export inet_lookup_reuseport and inet6_lookup_reuseport
- net: remove duplicate reuseport_lookup functions
- udp: Avoid call to compute_score on multiple sites
- cppc_cpufreq: Fix possible null pointer dereference
- scsi: libsas: Fix the failure of adding phy with zero-address to port
- scsi: hpsa: Fix allocation size for Scsi_Host private data
- [x86] purgatory: Switch to the position-independent small code model
- thermal/drivers/tsens: Fix null pointer dereference
- wifi: ath10k: Fix an error code problem in
ath10k_dbg_sta_write_peer_debug_trigger()
- wifi: ath10k: populate board data for WCN3990
- net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset
handlers
- net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family
switches
- tcp: avoid premature drops in tcp_add_backlog()
- pwm: sti: Convert to platform remove callback returning void
- pwm: sti: Prepare removing pwm_chip from driver data
- pwm: sti: Simplify probe function using devm functions
- drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
- drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
- drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()
- net: give more chances to rcu in netdev_wait_allrefs_any()
- wifi: carl9170: add a proper sanity check for endpoints
- wifi: ar5523: enable proper endpoint verification
- wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
- libbpf: Fix error message in attach_kprobe_multi
- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
- scsi: bfa: Ensure the copied buf is NUL terminated
- scsi: qedf: Ensure the copied buf is NUL terminated
- scsi: qla2xxx: Fix debugfs output for fw_resource_count
- kernel/numa.c: Move logging out of numa.h
- [x86] numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks()
- wifi: mwl8k: initialize cmd->addr[] properly
- HID: amd_sfh: Handle "no sensors" in PM operations
- usb: aqc111: stop lying about skb->truesize
- net: usb: sr9700: stop lying about skb->truesize
- net: ipv6: fix wrong start position when receive hop-by-hop fragment
- eth: sungem: remove .ndo_poll_controller to avoid deadlocks
- net: ethernet: cortina: Locking fixes
- af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
- net: usb: smsc95xx: stop lying about skb->truesize
- net: openvswitch: fix overwriting ct original tuple for ICMPv6
- ipv6: sr: add missing seg6_local_exit
- ipv6: sr: fix incorrect unregister order
- ipv6: sr: fix invalid unregister error path
- net/mlx5: Add a timeout to acquire the command queue semaphore
- net/mlx5: Discard command completions in internal error
- [s390x] bpf: Emit a barrier for BPF_FETCH instructions
- riscv, bpf: make some atomic operations fully ordered
- ax25: Use kernel universal linked list to implement ax25_dev_list
- ax25: Fix reference count leak issues of ax25_dev
- ax25: Fix reference count leak issue of net_device
- mptcp: SO_KEEPALIVE: fix getsockopt support
- Bluetooth: Consolidate code around sk_alloc into a helper function
- Bluetooth: compute LE flow credits based on recvbuf space
- Bluetooth: qca: Fix error code in qca_read_fw_build_info()
- drm/bridge: Fix improper bridge init order with pre_enable_prev_first
- printk: Let no_printk() use _printk()
- dev_printk: Add and use dev_no_printk()
- drm/lcdif: Do not disable clocks on already suspended hardware
- drm/panel-samsung-atna33xc20: Use ktime_get_boottime for delays
- drm/dp: Don't attempt AUX transfers when eDP panels are not powered
- drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't
assert
- drm/amd/display: Fix potential index out of bounds in color transformation
function
- [x86] ASoC: Intel: Disable route checks for Skylake boards
- [x86] ASoC: Intel: avs: ssm4567: Do not ignore route checks
- mtd: core: Report error if first mtd_otp_size() call fails in
mtd_otp_nvmem_add()
- mtd: rawnand: hynix: fixed typo
- fbdev: shmobile: fix snprintf truncation
- [armel,armhf] ASoC: kirkwood: Fix potential NULL dereference
- drm/meson: vclk: fix calculation of 59.94 fractional rates
- drm/mediatek: Add 0 size check to mtk_drm_gem_obj
- [powerpc*] fsl-soc: hide unused const variable
- fbdev: sisfb: hide unused variables
- [x86] ASoC: Intel: avs: Fix ASRC module initialization
- [x86] ASoC: Intel: avs: Fix potential integer overflow
- media: ngene: Add dvb_ca_en50221_init return value check
- media: rcar-vin: work around -Wenum-compare-conditional warning
- media: radio-shark2: Avoid led_names truncations
- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
- [arm64] drm/msm/dp: allow voltage swing / pre emphasis of 3
- [arm64] drm/msm/dp: Return IRQ_NONE for unhandled interrupts
- [arm64] drm/msm/dp: Avoid a long timeout for AUX transfer if nothing
connected
- media: ipu3-cio2: Request IRQ earlier
- media: dt-bindings: ovti,ov2680: Fix the power supply names
- fbdev: sh7760fb: allow modular build
- media: atomisp: ssh_css: Fix a null-pointer dereference in
load_video_binaries
- [arm64] drm/arm/malidp: fix a possible null pointer dereference
(CVE-2024-36014)
- drm: vc4: Fix possible null pointer dereference
- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
- drm/bridge: anx7625: Don't log an error when DSI host can't be found
- drm/bridge: icn6211: Don't log an error when DSI host can't be found
- drm/bridge: lt8912b: Don't log an error when DSI host can't be found
- drm/bridge: lt9611: Don't log an error when DSI host can't be found
- drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found
- drm/bridge: tc358775: Don't log an error when DSI host can't be found
- drm/bridge: dpc3433: Don't log an error when DSI host can't be found
- drm/panel: novatek-nt35950: Don't log an error when DSI host can't be
found
- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
- drm/mipi-dsi: use correct return type for the DSC functions
- drm/rockchip: vop2: Do not divide height twice for YUV
- clk: samsung: exynosautov9: fix wrong pll clock id value
- RDMA/mlx5: Adding remote atomic access flag to updatable flags
- [arm64] RDMA/hns: Fix return value in hns_roce_map_mr_sg
- [arm64] RDMA/hns: Fix deadlock on SRQ async events.
- [arm64] RDMA/hns: Fix UAF for cq async event
- [arm64] RDMA/hns: Fix GMV table pagesize
- [arm64] RDMA/hns: Use complete parentheses in macros
- [arm64] RDMA/hns: Modify the print level of CQE error
- clk: mediatek: mt8365-mm: fix DPI0 parent
- clk: rs9: fix wrong default value for clock amplitude
- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
- RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c
- RDMA/rxe: Fix incorrect rxe_put in error path
- IB/mlx5: Use __iowrite64_copy() for write combining stores
- clk: renesas: r8a779a0: Fix CANFD parent clock
- clk: renesas: r9a07g043: Add clock and reset entry for PLIC
- lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
- clk: qcom: dispcc-sm8450: fix DisplayPort clocks
- clk: qcom: dispcc-sm6350: fix DisplayPort clocks
- clk: qcom: mmcc-msm8998: fix venus clock issue
- [x86] insn: Fix PUSH instruction in x86 instruction decoder opcode map
- [x86] insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and
VPDPWSSDS
- ext4: avoid excessive credit estimate in ext4_tmpfile()
- virt: acrn: stop using follow_pfn
- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
- sunrpc: removed redundant procp check
- ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple
- ext4: fix unit mismatch in ext4_mb_new_blocks_simple
- ext4: try all groups in ext4_mb_new_blocks_simple
- ext4: remove unused parameter from ext4_mb_new_blocks_simple()
- ext4: fix potential unnitialized variable
- SUNRPC: Fix gss_free_in_token_pages()
- RDMA/IPoIB: Fix format truncation compilation errors
- net: add pskb_may_pull_reason() helper
- net: bridge: xmit: make sure we have at least eth header len bytes
- net: bridge: mst: fix vlan use-after-free
- net: qrtr: ns: Fix module refcnt
- netrom: fix possible dead-lock in nr_rt_ioctl()
- af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
- sched/fair: Allow disabling sched_balance_newidle with
sched_relax_domain_level
- sched/core: Fix incorrect initialization of the 'burst' parameter in
cpu_max_write()
- scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
- perf record: Delete session after stopping sideband thread
- perf probe: Add missing libgen.h header needed for using basename()
- iio: core: Leave private pointer NULL when no private data supplied
- greybus: lights: check return of get_channel_from_mode
- f2fs: multidev: fix to recognize valid zero block address
- f2fs: fix to wait on page writeback in __clone_blkaddrs()
- counter: linux/counter.h: fix Excess kernel-doc description warning
- perf annotate: Get rid of duplicate --group option item
- soundwire: cadence: fix invalid PDI offset
- dmaengine: idma64: Add check for dma_set_max_seg_size
- firmware: dmi-id: add a release callback function
- serial: max3100: Lock port->lock when calling uart_handle_cts_change()
- serial: max3100: Update uart_driver_registered on driver removal
- serial: max3100: Fix bitwise types
- greybus: arche-ctrl: move device table to its right location
- PCI: tegra194: Fix probe path for Endpoint mode
- serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
- interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment
- [arm64] dts: meson: fix S4 power-controller node
- perf tests: Make "test data symbol" more robust on Neoverse N1
- dt-bindings: PCI: rcar-pci-host: Add optional regulators
- dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties
- f2fs: compress: fix to relocate check condition in
f2fs_{release,reserve}_compress_blocks()
- f2fs: compress: fix to relocate check condition in
f2fs_ioc_{,de}compress_file()
- f2fs: fix typos in comments
- f2fs: fix to relocate check condition in f2fs_fallocate()
- f2fs: fix to check pinfile flag in f2fs_move_file_range()
- iio: adc: stm32: Fixing err code to not indicate success
- coresight: etm4x: Fix unbalanced pm_runtime_enable()
- perf docs: Document bpf event modifier
- iio: pressure: dps310: support negative temperature values
- coresight: etm4x: Do not hardcode IOMEM access for register restore
- coresight: etm4x: Do not save/restore Data trace control registers
- coresight: etm4x: Safe access for TRCQCLTR
- coresight: etm4x: Fix access to resource selector registers
- fpga: region: add owner module and take its refcount
- microblaze: Remove gcc flag for non existing early_printk.c file
- microblaze: Remove early printk call from cpuinfo-static.c
- perf intel-pt: Fix unassigned instruction op (discovered by
MemorySanitizer)
- ovl: remove upper umask handling from ovl_create_upper()
- VMCI: Fix an error handling path in vmci_guest_probe_device()
- dt-bindings: pinctrl: mediatek: mt7622: fix array properties
- watchdog: bd9576: Drop "always-running" property
- watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe()
- usb: gadget: u_audio: Fix race condition use of controls after free during
gadget unbind.
- usb: gadget: u_audio: Clear uac pointer when freed.
- stm class: Fix a double free in stm_register_device()
- ppdev: Remove usage of the deprecated ida_simple_xx() API
- ppdev: Add an error check in register_device (CVE-2024-36015)
- perf bench internals inject-build-id: Fix trap divide when collecting just
one DSO
- perf ui browser: Don't save pointer to stack memory
- extcon: max8997: select IRQ_DOMAIN instead of depending on it
- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
- perf ui browser: Avoid SEGV on title
- perf report: Avoid SEGV in report__setup_sample_type()
- f2fs: compress: fix to update i_compr_blocks correctly
- f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/
cp_rwsem lock
- f2fs: fix to release node block count in error path of
f2fs_new_node_page()
- f2fs: compress: don't allow unaligned truncation on released compress
inode
- serial: sh-sci: protect invalidating RXDMA on shutdown
- libsubcmd: Fix parse-options memory leak
- perf daemon: Fix file leak in daemon_session__control
- f2fs: fix to add missing iput() in gc_data_segment()
- perf stat: Don't display metric header for non-leader uncore events
- [s390x] vdso: filter out mno-pic-data-is-text-relative cflag
- [s390x] vdso64: filter out munaligned-symbols flag for vdso
- [s390x] vdso: Generate unwind information for C modules
- [s390x] vdso: Use standard stack frame layout
- [s390x] ipl: Fix incorrect initialization of len fields in nvme reipl
block
- [s390x] ipl: Fix incorrect initialization of nvme dump block
- [s390x] boot: Remove alt_stfle_fac_list from decompressor
- Input: ims-pcu - fix printf string overflow
- Input: ioc3kbd - convert to platform remove callback returning void
- Input: ioc3kbd - add device table
- mmc: sdhci_am654: Add tuning algorithm for delay chain
- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
- mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
- mmc: sdhci_am654: Add OTAP/ITAP delay enable
- mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
- mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
- [arm64] drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode
pclk
- [arm64] drm/msm/dpu: Always flush the slave INTF on the CTL
- drm/bridge: tc358775: fix support for jeida-18 and jeida-24
- media: stk1160: fix bounds checking in stk1160_copy_video()
- scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
- Input: cyapa - add missing input core locking to suspend/resume functions
- media: flexcop-usb: fix sanity check of bNumEndpoints
- [powerpc*] pseries: Add failure related checks for h_get_mpp and h_get_ppp
- media: sunxi: a83-mips-csi2: also select GENERIC_PHY
- media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
- media: cec: cec-api: add locking in cec_release()
- media: cec: core: avoid recursive cec_claim_log_addrs
- media: cec: core: avoid confusing "transmit timed out" message
- Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
- [arm64] drm/msm: Enable clamp_to_idle for 7c3
- [arm64] drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting
fails
- null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
- ASoC: mediatek: mt8192: fix register configuration for tdm
- regulator: bd71828: Don't overwrite runtime voltages
- perf/arm-dmc620: Fix lockdep assert in ->event_init()
- [x86] kconfig: Select ARCH_WANT_FRAME_POINTERS again when
UNWINDER_FRAME_POINTER=y
- net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
- ipv6: sr: fix missing sk_buff release in seg6_input_core
- nfc: nci: Fix uninit-value in nci_rx_work
- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
- NFSv4: Fixup smatch warning for ambiguous return
- nfs: keep server info for remounts
- sunrpc: fix NFSACL RPC retry on soft mount
- rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
- af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
(CVE-2024-36972)
- ipv6: sr: fix memleak in seg6_hmac_init_algo
- tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
- pNFS/filelayout: fixup pNfs allocation modes
- openvswitch: Set the skbuff pkt_type for proper pmtud support.
- [arm64] asm-bug: Add .align 2 to the end of __BUG_ENTRY
- rv: Update rv_en(dis)able_monitor doc to match kernel-doc
- virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
- Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI"
- net: fec: avoid lock evasion when reading pps_enable
- tls: fix missing memory barrier in tls_init
- inet: factor out locked section of inet_accept() in a new helper
- net: relax socket state check at accept time.
- nfc: nci: Fix kcov check in nci_rx_work()
- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
- drivers/xen: Improve the late XenStore init protocol
- ice: Interpret .set_channels() input differently
- netfilter: nfnetlink_queue: acquire rcu_read_lock() in
instance_destroy_rcu()
- netfilter: nft_payload: restore vlan q-in-q match support
- spi: Don't mark message DMA mapped when no transfer in it is
- dma-mapping: benchmark: fix node id validation
- dma-mapping: benchmark: handle NUMA_NO_NODE correctly
- nvmet: fix ns enable/disable possible hang
- net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061
- net/mlx5: Lag, do bond only if slaves agree on roce state
- net/mlx5e: Fix IPsec tunnel mode offload feature check
- net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer
exhaustion
- net/mlx5e: Fix UDP GSO for encapsulated packets
- dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
- bpf: Fix potential integer overflow in resolve_btfids
- ALSA: jack: Use guard() for locking
- ALSA: core: Remove debugfs at disconnection
- ALSA: hda/realtek: Add quirk for ASUS ROG G634Z
- ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
- ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
- enic: Validate length of nl attributes in enic_set_vf_port
- af_unix: Read sk->sk_hash under bindlock during bind().
- net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
- bpf: Allow delete from sockmap/sockhash only if update is allowed
- net:fec: Add fec_enet_deinit()
- ice: fix accounting if a VLAN already exists
- netfilter: nft_payload: move struct nft_payload_set definition where it
belongs
- netfilter: nft_payload: rebuild vlan header when needed
- netfilter: nft_payload: rebuild vlan header on h_proto access
- netfilter: nft_payload: skbuff vlan metadata mangle support
- netfilter: tproxy: bail out if IP has been disabled on the device
- netfilter: nft_fib: allow from forward/input without iif selector
- kconfig: fix comparison to constant symbols, 'm', 'n'
- [x86] drm/i915/guc: avoid FIELD_PREP warning
- spi: stm32: Don't warn about spurious interrupts
- net: dsa: microchip: fix RGMII error in KSZ DSA driver
- net: ena: Add dynamic recycling mechanism for rx buffers
- net: ena: Reduce lines with longer column width boundary
- net: ena: Fix redundant device NUMA node override
- ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
- [powerpc*] pseries/lparcfg: drop error message from guest name lookup
- hwmon: (shtc1) Fix property misspelling
- ALSA: timer: Set lower bound of start tick time
- net: ena: Fix DMA syncing in XDP path when SWIOTLB is on
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.94
- drm: Check output polling initialized before disabling (CVE-2024-35927)
- drm: Check polling initialized before enabling in
drm_helper_probe_single_connector_modes
- Bluetooth: btrtl: Add missing MODULE_FIRMWARE declarations
- maple_tree: fix allocation in mas_sparse_area()
- maple_tree: fix mas_empty_area_rev() null pointer dereference
(CVE-2024-36891)
- mmc: core: Do not force a retune before RPMB switch
- afs: Don't cross .backup mountpoint from backup volume
- nilfs2: fix use-after-free of timer for log writer thread (CVE-2024-38583)
- [x86] drm/i915/audio: Fix audio time stamp programming for DP
- mptcp: avoid some duplicate code in socket option handling
- mptcp: cleanup SOL_TCP handling
- mptcp: fix full TCP keep-alive support
- vxlan: Fix regression when dropping packets due to invalid src addresses
- scripts/gdb: fix SB_* constants parsing
- f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
- media: lgdt3306a: Add a check against null-pointer-def
- drm/amdgpu: add error handle to avoid out-of-bounds
- bcache: fix variable length array abuse in btree_iter
- wifi: rtw89: correct aSIFSTime for 6GHz band
- ata: pata_legacy: make legacy_exit() work again
- thermal/drivers/qcom/lmh: Check for SCM availability at probe
- [arm64] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
- ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
- [arm64] tegra: Correct Tegra132 I2C alias
- [arm64] dts: qcom: qcs404: fix bluetooth device address
- md/raid5: fix deadlock that raid5d() wait for itself to clear
MD_SB_CHANGE_PENDING
- wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of
firmware command
- wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
- wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
- wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
- wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
- [arm64] dts: hi3798cv200: fix the size of GICR
- media: mc: Fix graph walk in media_pipeline_start
- media: mc: mark the media devnode as registered from the, start
- media: mxl5xx: Move xpt structures off stack
- media: v4l2-core: hold videodev_lock until dev reg, finishes
- mmc: core: Add mmc_gpiod_set_cd_config() function
- mmc: sdhci: Add support for "Tuning Error" interrupts
- mmc: sdhci-acpi: Sort DMI quirks alphabetically
- mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working
- mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A
- mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on
Asus T100TA
- fbdev: savage: Handle err return when savagefb_check_var failed
- drm/amdgpu/atomfirmware: add intergrated info v2.3 table
- 9p: add missing locking around taking dentry fid list
- drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
- [arm64] KVM: arm64: Fix AArch32 register narrowing on userspace write
- [arm64] KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
- [arm64] KVM: arm64: AArch32: Fix spurious trapping of conditional
instructions
- crypto: ecdsa - Fix module auto-load on add-key
- crypto: ecrdsa - Fix module auto-load on add_key
- [x86] crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
- mm: fix race between __split_huge_pmd_locked() and GUP-fast
- scsi: core: Handle devices which return an unusually large VPD page count
- net/ipv6: Fix route deleting failure when metric equals 0
- net/9p: fix uninit-value in p9_client_rpc()
- kmsan: do not wipe out origin when doing partial unpoisoning
- cpufreq: amd-pstate: Fix the inconsistency in max frequency units
- [x86] intel_th: pci: Add Meteor Lake-S CPU support
- mm/cma: drop incorrect alignment check in cma_init_reserved_mem
- mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid
- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin
- kdb: Fix buffer overflow during tab-complete
- kdb: Use format-strings rather than '\0' injection in kdb_read()
- kdb: Fix console handling when editing and tab-completing commands
- kdb: Merge identical case statements in kdb_read()
- kdb: Use format-specifiers rather than memset() for padding in kdb_read()
- net: fix __dst_negative_advice() race (CVE-2024-36971)
- ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow
- ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
- [s390x] ap: Fix crash in AP internal function modify_bitmap()
- [s390x] cpacf: Split and rework cpacf query functions
- [s390x] cpacf: Make use of invalid opcode produce a link error
- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler
- EDAC/igen6: Convert PCIBIOS_* return codes to errnos
- nfs: fix undefined behavior in nfs_block_bits()
- NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
- btrfs: fix crash on racing fsync and size-extending write into prealloc
- [powerpc*] bpf: enforce full ordering for ATOMIC operations with BPF_FETCH
- smb: client: fix deadlock in smb2_find_smb_tcon()
- smp: Provide 'setup_max_cpus' definition on UP too
[ Uwe Kleine-König ]
* [arm*] Enable symbols in Raspberry Pi device trees for simplified overlay
application.
* d/rules: Let blhc ignore perf tests binaries that are compiled without
fortification
[ Salvatore Bonaccorso ]
* Bump ABI to 22
* [rt] Update to 6.1.90-rt30
* net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (CVE-2024-36974)
-- Salvatore Bonaccorso <email address hidden> Fri, 21 Jun 2024 05:59:28 +0200
