openembedded-core: Merge latest upstream#210
Open
Shreejit-03 wants to merge 97 commits into
Open
Conversation
Backport fixes for CVE-2026-33416 Backport patches from security debian tracker [1] also mentioned at NVD Report [2] [1] https://security-tracker.debian.org/tracker/CVE-2026-33416 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-33416 Add below patches to fix the CVE: CVE-2026-33416-01.patch CVE-2026-33416-02.patch CVE-2026-33416-03.patch CVE-2026-33416-04.patch Signed-off-by: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: Jérémy Rosen <jeremy.rosen@smile.fr> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Pick patches from [1] and [2] as mentioned in Debian report in [3]. [1] https://git.busybox.net/busybox/commit/archival?id=42202bfb1e6ac51fa995beda8be4d7b654aeee2a [2] https://git.busybox.net/busybox/commit/archival?id=d368f3f7836d1c2484c8f839316e5c93e76d4409 [3] https://security-tracker.debian.org/tracker/CVE-2026-29004 Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Pick patch from [1] as 5.4.x upstream backport of [2] mentioned in Debian report in [3]. [1] tukaani-project/xz@8538443 [2] tukaani-project/xz@c8c2286 [3] https://security-tracker.debian.org/tracker/CVE-2026-34743 Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Pick patch from [1] as 2.39.x upstream backport of [2] mentioned in Debian report in [3]. [1] util-linux/util-linux@7916466 [2] util-linux/util-linux@0ba0f14 [3] https://security-tracker.debian.org/tracker/CVE-2026-27456 Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Running 'devtool modify -n' on a kernel recipe that inherits 'kernel-yocto' can unintentionally corrupt an existing Git repo or worktree. The work-shared optimization introduced in 3c3a9ba ("devtool/standard.py: Update devtool modify to copy source from work-shared if its already downloaded") is not skipped when '--no-extract' ('args.no_extract') is set. As a result, for kernel builds where STAGING_KERNEL_DIR was already populated when running 'devtool modify -n', the existing source tree is overwritten (via oe.path.copyhardlinktree()) with the contents of STAGING_KERNEL_DIR. Fix by adding 'and not args.no_extract' to the kernel-yocto guard condition. (cherry picked from commit d383ea3) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/752081 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/758320 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/763767 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/763762 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/767860 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] mentionned in [2] [1] https://go.dev/cl/767520 [2] https://security-tracker.debian.org/tracker/CVE-2026-39817 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/763882 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] mentionned in [2] [1] https://go.dev/cl/759940 [2] https://security-tracker.debian.org/tracker/CVE-2026-39820 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/770541 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/771180 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/771520 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/775321 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/774481 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/777060 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
…es_info This is no more than a backport of the current (i.e., from 'master') version of this same chunk in save_debugsources_info(), where BP is used instead of PF to form the path to the kernel sources. This replacement in package.py is followed by a similar change in meta/classes/create-spdx-2.2.bbclass, so that 'BP' is also used in spdx_get_src() and we don't face any regressions in SPDX v2.2. As a matter of fact, SPDX3 also uses 'BP' in get_patched_src() (from spdx_common.py). Overall, this backport ensures a coherence between Scarthgap and master, namely regarding the how the kernel sources are provided by package.py and consumed by SPDX v2.2 and 3.0. Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com> Co-authored-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Correct spelling errors in the machine include README documentation for both ARM and x86 architectures to improve clarity. ARM changes: - Fix TUNE_PKGACH -> TUNE_PKGARCH. - Fix "definiton" -> "definition". - Fix "Curently" -> "Currently". - Fix "specificed" -> "specified". x86 changes: - Fix "define" -> "defined". - Fix "to to" duplication. Signed-off-by: Prabhudasu Vatala <prabhudasuvatala@gmail.com> (cherry picked from commit a77dd22) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] also mentioned at Debian report in [2] [1] golang/go@abaa0cb [2] https://security-tracker.debian.org/tracker/CVE-2026-27140 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-27140 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] & [2] also mentioned at Debian report in [3] & [4] [1] golang/go@7d2dd34 [2] golang/go@72cc336 [3] https://security-tracker.debian.org/tracker/CVE-2026-27143 [4] https://security-tracker.debian.org/tracker/CVE-2026-27144 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
CVE-2021-36217 is rejected, and should no longer be referenced. CVE-2021-36217 is a duplicate of CVE-2021-3502 which is already referenced in the local-ping.patch. The CVE database indicates the following reason: ConsultIDs: CVE-2021-3502. Reason: This candidate is a duplicate of CVE-2021-3502. Notes: All CVE users should reference CVE-2021-3502 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. (cherry picked from commit bf41240) Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
With the current solution, using a separate task (do_create_kernel_config_spdx) there is a dependency issue. Sometimes the final rootfs SBOM does not contain the CONFIG_ values. do_create_kernel_config_spdx is executed after do_create_spdx which deploys the SPDX file. do_create_kernel_config_spdx calls oe.sbom30.find_root_obj_in_jsonld to read from the deploy directory, which is OK, but the do_create_kernel_config_spdx ends up writing to this deployed file (updating it). do_create_rootfs_spdx has an explicit dependency to all do_create_spdx tasks, but there is nothing that prevents executing do_create_kernel_config_spdx after do_create_rootfs_spdx. To fix it, instead, now read from the workdir, and write to the workdir, and do the processing from the do_create_spdx task: we append to the do_create_spdx task. Furthermore, update oeqa selftest to execute do_create_spdx instead of removed function. Also only execute this task if create-spdx-3.0 was inherited, previously this code could be executed if create-spdx-2.2 is inherited. (cherry picked from commit 8417f4a) Fixes: 1fff29a ("kernel.bbclass: Add task to export kernel configuration to SPDX") Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Reviewed-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This patch fix use after free in websocket handshake code. Backport patch from debian refer : https://security-tracker.debian.org/tracker/CVE-2025-11234 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1]. [1] https://security-tracker.debian.org/tracker/CVE-2006-10003 More details : https://nvd.nist.gov/vuln/detail/CVE-2006-10003 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] also mentioned at NVD report in [2] [1] python/cpython@05ed7ce [2] https://nvd.nist.gov/vuln/detail/CVE-2026-1502 [3] https://security-tracker.debian.org/tracker/CVE-2026-1502 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] also mentioned at NVD report in [2] [1] python/cpython@c3cf71c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-6100 [3] https://security-tracker.debian.org/tracker/CVE-2026-6100 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [1] [1] https://lists.x.org/archives/xorg-announce/2026-April/003677.html [2] https://security-tracker.debian.org/tracker/CVE-2026-33999 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
142cd8382222 Linux 6.6.136
deeaba4c54ae md/raid1: fix data lost for writemostly rdev
1fa36cf495b0 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
09427bcb1715 crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
b5c14bd4da1f crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
607ba280f2ad crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
c89c768734f3 crypto: testmgr - Hide ENOENT errors better
695cac6ed284 crypto: testmgr - Hide ENOENT errors
74e2db36fe50 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
f6634af5de72 ALSA: caiaq: take a reference on the USB device in create_card()
86fc28191418 ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
ef57cd3329b4 f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
8d5729350b23 ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
ffbce350c6fd ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
a34d456934fe smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
b53b8e98c233 smb: client: require a full NFS mode SID before reading mode bits
0521a67e4b0f smb: server: fix max_connections off-by-one in tcp accept path
97f8d2648ef4 smb: server: fix active_num_conn leak on transport allocation failure
b3e0e7dd53f1 fuse: quiet down complaints in fuse_conn_limit_write
f1441a1ecace fuse: Check for large folio with SPLICE_F_MOVE
d23ad78bfd20 fuse: reject oversized dirents in page cache
a76c1cad4e80 f2fs: fix to avoid memory leak in f2fs_rename()
f90b8a1798b7 fs/ntfs3: validate rec->used in journal-replay file record check
a6bcf8010af0 rxrpc: only handle RESPONSE during service challenge
d6a76b3600e1 rxrpc: Fix anonymous key handling
6669cf805940 scripts/dtc: Remove unused dts_version in dtc-lexer.l
cf044df0901f Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
e2c9dc6b6e96 ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
37f074e65f24 ocfs2: validate inline data i_size during inode read
4bf8cd09f427 ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
c98b6fa86b33 rxrpc: Fix key quota calculation for multitoken keys
e297bb2c2568 KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
f363c496e203 scripts: generate_rust_analyzer.py: define scripts
ceb73484e720 PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
7ad01905831c net: annotate data-races around sk->sk_{data_ready,write_space}
fa5d5baf67f6 i40e: Fix preempt count leak in napi poll tracepoint
71ca90c26eef net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
f77b51bcee7b wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
10f4ff4baeb6 md/raid1,raid10: don't ignore IO flags
50352fc10392 ipv6: add NULL checks for idev in SRv6 paths
e238ab12556b PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
ebc8815a917f Revert "perf unwind-libdw: Fix invalid reference counts"
45cbaf5c7cdc media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
e3957eb26a3d media: vidtv: fix pass-by-value structs causing MSAN warnings
7318e3549518 nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
cb8092038e95 media: as102: fix to not free memory after the device is registered in as102_usb_probe()
47fa09fe7f3e bcache: fix cached_dev.sb_bio use-after-free and crash
e88354b381e2 ALSA: 6fire: fix use-after-free on disconnect
b5d141ea15f1 media: em28xx: fix use-after-free in em28xx_v4l2_open()
9a9bdaf9dc42 media: mediatek: vcodec: fix use-after-free in encoder release path
17cb7957c979 media: vidtv: fix nfeeds state corruption on start_streaming failure
115a5266749d mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
cec74b2ab7df mm/kasan: fix double free for kasan pXds
887632163b54 ASoC: qcom: q6apm: move component registration to unmanaged version
dc6a6c3db3a4 KVM: x86: Use scratch field in MMIO fragment to hold small write values
24b1e0d5d254 checkpatch: add support for Assisted-by tag
e0c211a0c261 ice: Fix memory leak in ice_set_ringparam()
e6661add2d9c nf_tables: nft_dynset: fix possible stateful expression memleak in error path
aaba6ee63ba6 blktrace: fix __this_cpu_read/write in preemptible context
9df613ef6e8e nfc: nci: complete pending data exchange on device close
4604b7b4eee6 net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
5afb9356a2e5 KVM: nVMX: Fold requested virtual interrupt check into has_nested_events()
002a73470b56 net: add proper RCU protection to /proc/net/ptype
f9d4b618f1b9 iio: common: st_sensors: Fix use of uninitialize device structs
36f127b971c0 btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io()
128b03ccb258 net: skb: fix cross-cache free of KFENCE-allocated skb head
b670833749ff KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
6575f9fbf084 ocfs2: handle invalid dinode in ocfs2_group_extend
6f072daefcab ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
4b80b5a838a3 ocfs2: fix possible deadlock between unlink and dio_end_io_write
b7efb4c94797 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
426ef05e82ee dcache: Limit the minimal number of bucket to two
452894005b4a ALSA: ctxfi: Limit PTP to a single page
6718df49e5a7 Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
554391e7da68 USB: serial: option: add Telit Cinterion FN990A MBIM composition
779412e0e391 staging: sm750fb: fix division by zero in ps_to_hz()
f632987306bc wifi: rtw88: fix device leak on probe failure
e2f8c5d134f7 scripts: generate_rust_analyzer.py: avoid FD leak
cce24f70090e fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
301857c5ac27 usb: port: add delay after usb_hub_set_port_power()
8fb82e3555a7 USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
9dec3276d122 usb: storage: Expand range of matched versions for VL817 quirks entry
885c8591784d usbip: validate number_of_packets in usbip_pack_ret_submit()
745a535461bb ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
b5b5d5936a50 ksmbd: require 3 sub-authorities before reading sub_auth[2]
4b73376feecb ksmbd: validate EaNameLength in smb2_get_ea()
bfbc74df8bbe smb: client: fix off-by-8 bounds check in check_wsl_eas()
1b2bfedccc4f usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
9ceff1251904 usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
0f156bb5334e usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
859a239d58a8 fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
f856f4b6efd5 ALSA: fireworks: bound device-supplied status before string array lookup
63c11b19cdc1 drm/vc4: platform_get_irq_byname() returns an int
2819f34e08bd NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
d4e1946bea8d net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
932ae5309e53 HID: core: clamp report_size in s32ton() to avoid undefined shift
c8cc765253ad HID: alps: fix NULL pointer dereference in alps_raw_event()
c65ee4d3be5d staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
fa00738ab30b i2c: s3c24xx: check the size of the SMBUS message before using it
5e9cfffad898 can: raw: fix ro->uniq use-after-free in raw_rcv()
0eb1263a3b8c nfc: llcp: add missing return after LLCP_CLOSED checks
e2e0e7884314 drm/i915/psr: Do not use pipe_src as borders for SU area
7ab1832fe163 objtool: Remove max symbol name length limitation
29d39948ce52 ALSA: usb-audio: Improve Focusrite sample rate filtering
c5e918390002 netfilter: conntrack: add missing netlink policy validations
e86ab1e56613 crypto: algif_aead - Fix minimum RX size check for decryption
cfab2c817d2e perf/x86/intel/uncore: Skip discovery table for offline dies
1981e469558b gpio: tegra: fix irq_release_resources calling enable instead of disable
9ccce02d5013 l2tp: Drop large packets with UDP encap
ae8343a19ccb net: ipa: fix event ring index not programmed for IPA v5.0+
a7d326dfb13b net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
b9232421a77a af_unix: read UNIX_DIAG_VFS data under unix_state_lock
00e1d650fa4b net: txgbe: leave space for null terminators on property_entry
288138418bef netfilter: ip6t_eui64: reject invalid MAC header for all packets
36bf0d98e180 netfilter: xt_multiport: validate range encoding in checkentry
368c22aea490 netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
730663352c91 ipvs: fix NULL deref in ip_vs_add_service error path
c4d93470aff0 selftests: net: bridge_vlan_mcast: wait for h1 before querier check
d3125c541a96 xfrm_user: fix info leak in build_mapping()
b66920a3348c xfrm: Wait for RCU readers during policy netns exit
a55793e5a97d xsk: validate MTU against usable frame size on bind
81ab60836b27 xsk: fix XDP_UMEM_SG_FLAG issues
cfcc8a82ad03 xsk: respect tailroom for ZC setups
a03975beb9f6 xsk: tighten UMEM headroom validation to account for tailroom and min frame
c9eef0760db4 e1000: check return value of e1000_read_eeprom
d8a747057a17 ixgbevf: add missing negotiate_features op to Hyper-V ops table
feba4907c302 tracing/probe: reject non-closed empty immediate strings
7a01c81120f5 dt-bindings: net: Fix Tegra234 MGBE PTP clock
366f890831ff net: stmmac: Fix PTP ref clock for Tegra234
d8c2aa3c4a1e nfc: s3fwrn5: allocate rx skb before consuming bytes
47a8bf52156a ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
363a38044b8c net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
eb3765b90eb8 net: sched: act_csum: validate nested VLAN headers
a6566cd33f6f eventpoll: defer struct eventpoll free to RCU grace period
34160cca50ec drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
dd5c49787a32 drm/vc4: Fix a memory leak in hang state error path
a812008fe3a0 drm/vc4: Fix memory leak of BO array in hang state
5befb65dca90 drm/vc4: Release runtime PM reference after binding V3D
96f71e3a7f9b PCI: hv: Set default NUMA node to 0 for devices without affinity info
6948caaff66d arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
d4d11b70a30f soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
f0288da67320 ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
3ec7437e9d11 wifi: brcmfmac: validate bsscfg indices in IF events
cf50a1178dfc ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
e6a445513fbc HID: roccat: fix use-after-free in roccat_report_event
40f40229baa7 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
e73692e0e271 HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
a9098b43562f platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
36af81124ca8 pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
b17dcf3c9cb4 ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
5d4fe469fe7d fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
7b73bea718fe ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
e51cd8954919 ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
b6ba1eacf276 wifi: wl1251: validate packet IDs before indexing tx_frames
d7b59c2e6109 ALSA: hda/realtek: add quirk for Framework F111:000F
fa4f1f52528c netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
b345586c9fe8 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
c09a7446aab5 btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
aa77bd6d08f0 can: mcp251x: add error handling for power enable in open and resume
5c37bd025068 ASoC: SOF: topology: reject invalid vendor array size in token parser
64e4ced7dd47 ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
719df67c2003 ALSA: asihpi: avoid write overflow check warning
384c3f844f53 media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
e0c656cbb2a7 ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
1e1015643535 ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
2cd86c2cd771 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
62298a48f8b8 RDMA/irdma: Fix double free related to rereg_user_mr
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
258cf62a6dfde Linux 6.6.137
4b4defd2fce3f Buffer overflow in drivers/xen/sys-hypervisor.c
402d84ad9e89b xen/privcmd: fix double free via VMA splitting
710a4ce5d7afd crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
3ef530ef5585f crypto: authencesn - Fix src offset when decrypting in-place
d0c4ff6812386 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
60c798725c966 crypto: authenc - use memcpy_sglist() instead of null skcipher
c2138c9bd02af crypto: algif_aead - snapshot IV for async AEAD requests
3115af9644c34 crypto: algif_aead - Revert to operating out-of-place
dbea57c08acfc crypto: algif_aead - use memcpy_sglist() instead of null skcipher
9ec26b5d193c9 crypto: scatterwalk - Backport memcpy_sglist()
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
3b9f64db04968 Linux 6.6.138
50ed1e7873100 xfrm: esp: avoid in-place decrypt on shared skb frags
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
eac8889a3a1c Linux 6.6.140
4c3ed344a970 smb: client: use kzalloc to zero-initialize security descriptor buffer
2074dfffad76 Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
b94588f5a697 crypto: nx - fix context leak in nx842_crypto_free_ctx
d7e42dc47beb Bluetooth: MGMT: Fix memory leak in set_ssp_complete
f7c14993dc2f mtd: spi-nor: sst: Fix SST write failure
5bb5faff4837 drm/amdgpu/vcn4: Avoid overflow on msg bound check
1936310f68c5 drm/amdgpu/vcn3: Avoid overflow on msg bound check
9b2c795bb2c6 vsock/virtio: fix length and offset in tap skb for split packets
65c484726e74 vsock/virtio: fix accept queue count leak on transport mismatch
a998a7e250bf vsock: fix buffer size clamping order
944d76f749dd KVM: arm64: Wake-up from WFI when iqrchip is in userspace
83ce43a21bb7 ceph: only d_add() negative dentries when they are unhashed
09a69a3d8f97 usb: dwc3: Move GUID programming after PHY initialization
033c80d80fd1 tracing/probes: Limit size of event probe to 3K
f5ee467b5676 btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
6b57d6e4c302 batman-adv: tp_meter: fix tp_num leak on kmalloc failure
79bc0eaeef2c batman-adv: stop tp_meter sessions during mesh teardown
c2287250ba69 pwm: imx-tpm: Count the number of enabled channels in probe
3666c037fbde mtd: spi-nor: sst: Fix write enable before AAI sequence
b7cd63d13fae mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`
0000a7780e0e ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
b32f4cd81ef5 mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
8e7317598d72 usb: typec: tcpm: reset internal port states on soft reset AMS
2b26b1ec4c1d mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
0dd8917f35da mm/damon/core: implement damon_kdamond_pid()
7c504ffab3ef rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
cfa4267b5075 mm/damon/core: disallow time-quota setting zero esz
172dcb67dd35 bonding: fix use-after-free due to enslave fail after slave array update
cf1fd517f892 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
c0428a22daf6 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
594973a2e549 fbcon: Avoid OOB font access if console rotation fails
f4b177f96955 spi: microchip-core-qspi: fix controller deregistration
091499f90e09 spi: microchip-core-qspi: Use helper function devm_clk_get_enabled()
420d6f5e3fb4 mm/hugetlb_cma: round up per_node before logging it
fa7aaaed583a spi: uniphier: fix controller deregistration
3e272e6be1a2 spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
c9577d966503 spi: uniphier: switch to use modern name
664b60985a77 spi: tegra20-sflash: fix controller deregistration
4541a6cbec27 spi: tegra114: fix controller deregistration
df771f250402 spi: sun6i: fix controller deregistration
9da85b209f26 spi: sun6i: switch to use modern name
7fd0c4fd2185 spi: zynq-qspi: fix controller deregistration
dc2044ef3647 spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
ae6ee9f16538 spi: zynq-qspi: switch to use modern name
db96551920e2 spi: ti-qspi: fix controller deregistration
25ba53c43f30 spi: spi-ti-qspi: switch to use modern name
3b6cededf65a spi: spi-ti-qspi: Convert to platform remove callback returning void
1cdba535877d spi: sun4i: fix controller deregistration
79a38ff2bd3d spi: sun4i: switch to use modern name
904ff4e79961 spi: syncuacer: fix controller deregistration
5bbe69946620 spi: synquacer: switch to use modern name
6823f730bf19 Bluetooth: hci_conn: fix potential UAF in create_big_sync
b4a53add2fa8 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
0555d4f52623 xfrm: ah: account for ESN high bits in async callbacks
9d3968c48367 net: ipv6: stop checking crypto_ahash_alignmask
0841fc6a36c3 net: ipv4: stop checking crypto_ahash_alignmask
7e78a5bcbd65 ALSA: seq: Fix UMP group 16 filtering
dbacde3d4755 ALSA: seq: Notify client and port info changes
3915715273cd ALSA: core: Serialize deferred fasync state checks
fe337552143f ALSA: misc: Use guard() for spin locks
409fb34c1860 ALSA: hda: cs35l56: Propagate ASP TX source control errors
247ed8a969f9 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
e1c50b273298 net: stmmac: Prevent NULL deref when RX memory exhausted
8a2c91de61ff net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
6a74af77eba5 net: stmmac: avoid shadowing global buf_sz
2adbfca7452e crypto: caam - guard HMAC key hex dumps in hash_digest_key
f3a3e2dac5ec printk: add print_hex_dump_devel()
43a878639b90 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
6923cde8dc1d crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
268ae55a4c4f crypto: nx - Migrate to scomp API
c5fa7465794c crypto: nx - Avoid -Wflex-array-member-not-at-end warning
bf96052d617b ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
e1c24ce7573d wifi: rtl8xxxu: fix potential use of uninitialized value
3ca80e3012c8 hfsplus: fix held lock freed on hfsplus_fill_super()
61a790974ff7 hfsplus: fix uninit-value by validating catalog record size
82fb9da6477d xfs: fix a resource leak in xfs_alloc_buftarg()
b58baa1d50aa mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
058b451b1039 udf: fix partition descriptor append bookkeeping
401a49b7f26e firmware: google: framebuffer: Do not unregister platform device
2a40f8bc9bb7 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
a2c817c62943 spi: fix resource leaks on device setup failure
4c4641366143 net: qrtr: ns: Limit the total number of nodes
0dbec101a707 net: qrtr: ns: Limit the maximum number of lookups
e6f6cd501fb5 net: qrtr: ns: Limit the maximum server registration per node
0b9e4bbfb7c9 net: bridge: use a stable FDB dst snapshot in RCU readers
218b772e4815 net: mctp: fix don't require received header reserved bits to be zero
6a2d6273b6c3 RDMA/mana_ib: Disable RX steering on RSS QP destroy
8d4edc89bf71 sched: Use u64 for bandwidth ratio calculations
ede9eca9701d block: relax pgmap check in bio_add_page for compatible zone device pages
18d6a7c9e4e6 media: rc: igorplugusb: heed coherency rules
69b3a50dee62 ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
32fbdb6d6718 media: rc: ttusbir: respect DMA coherency rules
35bcafc82254 ALSA: aoa: i2sbus: clear stale prepared state
a045146109ea ALSA: aoa: Use guard() for mutex locks
07f9bff69da8 ipmi:ssif: Clean up kthread on errors
1f5e011fc8c8 ipmi:ssif: Fix a shutdown race
37a430a2d4e6 thermal: core: Fix thermal zone governor cleanup issues
78509c488c5d PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
801000afc9c9 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
b3303d6e92f6 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
b968db3b8b4f wifi: mt76: connac: introduce helper for mt7925 chipset
8dc5b98c20aa arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
bf477abd448c lib: test_hmm: evict device pages on file close to avoid use-after-free
11869ce402d9 wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
7edd983e42ee f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
35baa66a8cd7 ksmbd: replace connection list with hash table
b0b3d62d7230 ksmbd: use msleep instaed of schedule_timeout_interruptible()
1171f329cf1c f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
8e47d297e7cf smb: client: validate the whole DACL before rewriting it in cifsacl
325d4ac11f52 ksmbd: require minimum ACE size in smb_check_perm_dacl()
1593ddb37bd1 smb: common: change the data type of num_aces to le16
795dddb10687 smb: move some duplicate definitions to common/smbacl.h
65419eb4259a batman-adv: bla: put backbone reference on failed claim hash insert
7b8fbcee3184 batman-adv: bla: only purge non-released claims
368449e467d5 batman-adv: bla: prevent use-after-free when deleting claims
aafcbaf1159e batman-adv: stop caching unowned originator pointers in BAT IV
e4a3c4a4c8f6 batman-adv: reject new tp_meter sessions during teardown
f61499359fa5 batman-adv: fix integer overflow on buff_pos
1bfb06ecb00f sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
ee4c7a919761 drm/amdgpu/pm: align Hawaii mclk workaround with radeon
a103f1192dc7 drm/amdgpu/pm: add missing revision check for CI
4f7ca00fa91d drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
b5de35bafcd3 drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
91fbb5e635c8 drm/amdgpu: zero-initialize GART table on allocation
b8cbc52c73fa drm/radeon: add missing revision check for CI
91c6dc5a4169 drm/amdkfd: validate SVM ioctl nattr against buffer size
6b992591e04f drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
638d3e0b9eb7 drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
c72a8b4dc6d5 drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
944db9cfa537 drm/amdgpu/vce: Prevent partial address patches
1dc005775fb5 drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
0fb5cb556b24 drm/amdgpu: Add bounds checking to ib_{get,set}_value
4a8093c7def1 drm/amdkfd: Add upper bound check for num_of_nodes
1db431380879 drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
01eea4d12fb6 spi: cadence: fix unclocked access on unbind
31e7dd252bf7 spi: cadence: fix controller deregistration
bb6b50f709c5 spi: mpc52xx: fix use-after-free on unbind
59abb878f5a6 spi: orion: fix clock imbalance on registration failure
678a461af304 spi: orion: fix runtime pm leak on unbind
1f120e1a3e1e spi: imx: fix runtime pm leak on probe deferral
17aa64b8fe3e spi: img-spfi: fix controller deregistration
77defd64b405 spi: rspi: fix controller deregistration
c6f82bd90a71 spi: sprd: fix controller deregistration
6dd37ce42ac7 spi: coldfire-qspi: fix controller deregistration
3ad32a7140eb spi: bcmbca-hsspi: fix controller deregistration
562d954a1449 spi: fsl: fix controller deregistration
59da4cdd0c7b spi: sh-hspi: fix controller deregistration
863edec24c1d spi: mtk-nor: fix controller deregistration
4ea9a1ad663c spi: omap2-mcspi: fix controller deregistration
89c0a7762104 spi: fsl-espi: fix controller deregistration
2be39222d6ca spi: s3c64xx: fix controller deregistration
b9d4b9c3457c spi: dln2: fix controller deregistration
951694f9fab9 media: omap3isp: drop the use count of v4l2 pipeline
e85f1e23168f media: i2c: ov08d10: fix image vertical start setting
0b49f5dabc3a media: staging: imx: request mbus_config in csi_start
2dde85b42abd media: i2c: imx412: Assert reset GPIO during probe
97dbf8e69f3a media: dib8000: avoid division by 0 in dib8000_set_dds()
492c5292540f media: pci: zoran: fix potential memory leak in zoran_probe()
f3290d970bbe platform/x86: hp-wmi: Ignore backlight and FnLock events
3ce8f3057c51 media: saa7164: add ioremap return checks and cleanups
55be73783f11 spi: at91-usart: fix controller deregistration
70c2ee9cab5c spi: qup: fix controller deregistration
5a531cbb3bce spi: lantiq-ssc: fix controller deregistration
38321b03b8c2 regulator: bd9571mwv: fix OF node reference imbalance
0da216314247 regulator: act8945a: fix OF node reference imbalance
feb17524aa4e media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
da769e8f8e34 regulator: rk808: fix OF node reference imbalance
5b7471dce523 media: rc: streamzap: Error handling in probe
0cc9251833bf media: rc: xbox_remote: heed DMA restrictions
cd8f1633c3e8 regulator: max77650: fix OF node reference imbalance
e46b3b0c9c44 regulator: mt6357: fix OF node reference imbalance
8c7a281a9922 staging: media: atomisp: Disallow all private IOCTLs
f367ddf1299e spi: atmel: fix controller deregistration
725b90ce70a7 spi: bcm63xx: fix controller deregistration
fd10fb4c33bd media: i2c: ov8856: free control handler on error in ov8856_init_controls()
6467d656e689 media: uvcvideo: Enable VB2_DMABUF for metadata stream
0bc4cf1a6ba0 HID: playstation: Clamp num_touch_reports
df870e104571 exit: Sleep at TASK_IDLE when waiting for application core dump
0b8167e83647 LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
07d190e4ec68 LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
db7f65df10bd KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
70d12291805a KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
42dd1c91f993 f2fs: fix node_cnt race between extent node destroy and writeback
88b98e3cfb92 f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
72ec0749a1ba f2fs: fix fiemap boundary handling when read extent cache is incomplete
a2bcf16cdf79 f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
ebeb70e29e37 mptcp: fix scheduling with atomic in timestamp sockopt
a79bafdd4b63 mptcp: sockopt: set timestamp flags on subflow socket, not msk
bd36fb4f9446 mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
23e881c7fedb mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
114b4a6d4ede mptcp: fastclose msk when linger time is 0
ecc36a82ecfc RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
e3dc3a2fb05f RDMA/rxe: Reject unknown opcodes before ICRC processing
539cabb7b2d8 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
e01a957561f6 RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
a13c2ac4d480 RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
c5dc30da9900 RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
92582c6978d9 power: supply: max17042: avoid overflow when determining health
27f7c024ede4 PCI/AER: Stop ruling out unbound devices as error source
3937fa851992 PCI/AER: Clear only error bits in PCIe Device Status
b1e9f2d58707 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
971f17f5d910 KVM: x86: check for nEPT/nNPT in slow flush hypercalls
ba7f71b6161c smb: client: validate dacloffset before building DACL pointers
ef6495d4df6e smb/client: fix out-of-bounds read in symlink_data()
dffb44b2e06a smb/client: fix out-of-bounds read in smb2_compound_op()
e5c93847bf03 s390/debug: Reject zero-length input in debug_input_flush_fn()
fb4ae739811d RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
c741433f6c8d openvswitch: vport: fix self-deadlock on release of tunnel ports
9a4d7222c095 nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
d525ecf92228 nvme-apple: drop invalid put of admin queue reference count
4af2e558e6fd md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
2ae0afd98432 libceph: Fix slab-out-of-bounds access in auth message processing
470822125b62 lib/scatterlist: fix temp buffer in extract_user_to_sg()
3f17500e86d7 lib/scatterlist: fix length calculations in extract_kvec_to_sg
2aa77a18dc7f lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
bb0988ed4f2e isofs: validate block number from NFS file handle in isofs_export_iget
c9b37c8b73f6 isofs: validate Rock Ridge CE continuation extent against volume size
5489c98bc681 dm-verity-fec: correctly reject too-small hash devices
2e28bb9cc39f dm-verity-fec: correctly reject too-small FEC devices
ae9cd0b46b18 eventfs: Hold eventfs_mutex and SRCU when remount walks events
f0b0b09d9840 dm: fix a buffer overflow in ioctl processing
16fc9f57b5d7 dm: don't report warning when doing deferred remove
12161e03d33a dm-thin: fix metadata refcount underflow
c2670ec4aa49 btrfs: fix double free in create_space_info() error path
f7126b0b2455 ASoC: qcom: q6apm: remove child devices when apm is removed
3141d8b00cad ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
cb25b46a8dbe ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
ef1b78a68675 ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
a06bd365a587 ASoC: fsl_easrc: fix comment typo
d91e616474c6 ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
88f32a6806c8 cpuidle: powerpc: avoid double clear when breaking snooze
47bc7a03449c clk: microchip: mpfs-ccc: fix out of bounds access during output registration
be8af24ff376 clk: imx: imx8-acm: fix flags for acm clocks
d79e92161b65 spi: topcliff-pch: fix use-after-free on unbind
5f08cbdce0f3 thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
c040f6c5402c thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
50dfaf4a0277 udf: reject descriptors with oversized CRC length
82bc89fbb82d ibmveth: Disable GSO for packets with small MSS
9415a3fbf677 hv_sock: fix ARM64 support
a0ea2ee6ec05 gpio: of: clear OF_POPULATED on hog nodes in remove path
476254a6c87c extcon: ptn5150: handle pending IRQ events during system resume
2a5ed5055d1e cifs: change_conf needs to be called for session setup
ff519f87c36b cifs: abort open_cached_dir if we don't request leases
3d2ecbd444b0 block: add pgmap check to biovec_phys_mergeable
0d7e7235bc54 af_unix: Reject SIOCATMARK on non-stream sockets
d6c7f32094d6 hwmon: (corsair-psu) Close HID device on probe errors
39f0604bf1ae clk: rk808: fix OF node reference imbalance
0fc5303fa33d hwmon: (ltc2992) Fix u32 overflow in power read path
66daaf79de20 hwmon: (ltc2992) Clamp threshold writes to hardware range
c9a3b2fb4003 parisc: Fix IRQ leak in LASI driver
f94450ce5053 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
21d70744e6d3 net/rds: handle zerocopy send cleanup before the message is queued
eca62bb0569d ip6_gre: Use cached t->net in ip6erspan_changelink().
d3bd80404979 net: libwx: fix VF illegal register access
6162e8212e88 sound: ua101: fix division by zero at probe
0653c0516234 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
9a80c458320e mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
895ebbedf883 fanotify: fix false positive on permission events
f39501ea776f staging: vme_user: fix root device leak on init failure
1108b8722b9f spi: s3c64xx: fix NULL-deref on driver unbind
487f65651549 spi: zynqmp-gqspi: fix controller deregistration
5105f3e6b2df Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
ab77c8bc3026 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
6cb7f67bc28d Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
1e1e509b6fd2 Bluetooth: virtio_bt: validate rx pkt_type header length
ed41c81d30b2 Bluetooth: virtio_bt: clamp rx length before skb_put
4aec732807c5 selinux: prune /sys/fs/selinux/disable
01231051fa45 selinux: shrink critical section in sel_write_load()
ebd425067290 selinux: don't reserve xattr slot when we won't fill it
c2efc4956981 ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
3bf4e93ed085 xfrm: provide message size for XFRM_MSG_MAPPING
0f39c2626617 powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
cdbd10975b96 ALSA: firewire-tascam: Do not drop unread control events
b0c0d44adb55 usb: ulpi: fix memory leak on ulpi_register() error paths
20284bf5cc84 USB: serial: option: add Telit Cinterion LE910Cx compositions
9b92535cb729 USB: omap_udc: DMA: Don't enable burst 4 mode
91c3634bc6ac ALSA: usb-audio: Fix UAC3 cluster descriptor size check
e0e3dcf48189 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
a3c42466f45c ALSA: usb-audio: midi2: Restart output URBs on resume
d06d937b0a4c usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
6e29c32a2721 usb: usblp: fix heap leak in IEEE 1284 device ID via short response
ed4168d1a50f wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
c3d7b90dc950 wifi: b43: enforce bounds check on firmware key index in b43_rx()
fe75fa1ac9a9 wifi: mac80211: remove station if connection prep fails
83226c71af53 wifi: ath5k: do not access array OOB
95fcb436586d wifi: rsi: fix kthread lifetime race between self-exit and external-stop
03584528bfff wifi: mac80211: drop stray 'static' from fast-RX rx_result
1baaeb6adecb wifi: b43legacy: enforce bounds check on firmware key index in RX path
d04bc2355392 wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
e451c325b000 wifi: mt76: mt7921: fix a potential clc buffer length underflow
640b4c00fb0e exit: prevent preemption of oopsing TASK_DEAD task
e4bbd3521db0 bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
aa71ab2cc929 selftests/bpf: validate fake register spill/fill precision backtracking logic
2fcd619caecb bpf: handle fake register spill to stack with BPF_ST_MEM instruction
f013c1dafe93 selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros
c05c8db19cd3 bpf: track aligned STACK_ZERO cases as imprecise spilled registers
9d2cf5a4a378 selftests/bpf: validate zero preservation for sub-slot loads
d3b398ee3404 bpf: preserve constant zero when doing partial register restore
6d40191708e1 selftests/bpf: validate STACK_ZERO is preserved on subreg spill
57f41f1eac13 bpf: preserve STACK_ZERO slots on partial reg spills
c994886689fe selftests/bpf: add stack access precision test
e4da60feca4d bpf: support non-r10 register spill/fill to/from stack in precision tracking
36aa34f42cb6 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
898a1751b620 KVM: SVM: check validity of VMCB controls when returning from SMM
695b491dc3f2 dmaengine: idxd: Fix leaking event log memory
5ba95b119aa7 dmaengine: idxd: Fix crash when the event log is disabled
0305e7118451 net: txgbe: fix RTNL assertion warning when remove module
db104b0d8a78 flow_dissector: do not dissect PPPoE PFC frames
da54b3039d43 net: Fix icmp host relookup triggering ip_rt_bug
d51bf43193b1 iommu/amd: serialize sequence allocation under concurrent TLB invalidations
c28c87d9a389 iommu/amd: Use atomic64_inc_return() in iommu.c
488e386484ec KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
4772032a2c62 rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
4d08401aa13f ext4: validate p_idx bounds in ext4_ext_correct_indexes
e3bf143b1e98 rxrpc: Fix potential UAF after skb_unshare() failure
0d645c6d13fa spi: meson-spicc: Fix double-put in remove path
e2c2b044458c x86/shstk: Prevent deadlock during shstk sigreturn
21159d8b335a drm/amd/display: Do not skip unrelated mode changes in DSC validation
c79cf4232160 x86: shadow stacks: proper error handling for mmap lock
4a0bb8f9f71b spi: rockchip: fix controller deregistration
327a64241f30 ASoC: SOF: Don't allow pointer operations on unconfigured streams
cf3eb7c8e705 iommufd: Fix a race with concurrent allocation and unmap
3bb92bac4e27 ACPI: video: force native backlight on HP OMEN 16 (8A44)
95242430c136 ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
419d6c640da7 ACPI: scan: Use acpi_dev_put() in object add error paths
4f312c30f036 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
ce905b65e649 ipmi:si: Return state to normal if message allocation fails
2418e4b21fb1 ipmi: Check event message buffer response for bad data
67c44e0deba9 ipmi: Add limits to event and receive message requests
1f678d13e939 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
bffef0acec9c netfilter: reject zero shift in nft_bitwise
6bd17925bd68 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
50c6a1f05973 ALSA: caiaq: fix usb_dev refcount leak on probe failure
be0376affcaf drm/amdgpu: fix zero-size GDS range init on RDNA4
8e8be63465a5 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
e4389fb74cec ALSA: caiaq: Don't abort when no input device is available
be62c8bb03b6 ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
68532b09cbfc driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
b69933e97efe crypto: authencesn - reject short ahash digests during instance creation
e3cebcde0114 seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
262152ec3710 scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
8a1fc8d698ac rtmutex: Use waiter::task instead of current in remove_waiter()
a954061b334e ntfs3: fix integer overflow in run_unpack() volume boundary check
bf7ac4a1d3bf ntfs3: add buffer boundary checks to run_unpack()
98f4ba3480b9 ktest: Fix the month in the name of the failure directory
9d8fd84aab19 IB/core: Fix zero dmac race in neighbor resolution
35f6b3281efd dm mirror: fix integer overflow in create_dirty_log()
c5a45d14234b crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
5281e6e23023 crypto: atmel-tdes - fix DMA sync direction
3061c9bfb3f5 crypto: ccree - fix a memory leak in cc_mac_digest()
5b71db0780f1 crypto: hisilicon - Fix dma_unmap_single() direction
3f92c1de3bf1 crypto: atmel-ecc - Release client on allocation failure
b63f1e2f0e31 crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
d78ee361b365 crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
4b7d07747400 can: ucan: fix devres lifetime
204028af77a2 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
6cbf21775ee6 taskstats: set version in TGID exit notifications
ab5fdcd53564 tcp: call sk_data_ready() after listener migration
8bcc1cd237ab inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
33698bd1b2db md/raid5: validate payload size before accessing journal metadata
09880592f5a9 md/raid5: fix soft lockup in retry_aligned_read()
1bc1107a3a40 ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
ab6da97bc310 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
8bbed28f6b42 io_uring/poll: fix multishot recv missing EOF on wakeup race
d26f8c361f75 mtd: docg3: fix use-after-free in docg3_release()
980d6ba22747 mtd: docg3: Convert to platform remove callback returning void
ddb188b88d55 KVM: nSVM: Add missing consistency check for nCR3 validity
23ccf4affa6c KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
de6d8562a9cf KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
c0095cef7303 KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
83754e459c4b KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
ddc242a7bb44 KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
d218a0e8a63c KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
263640149d81 KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
36f36a6e4e74 KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
3ac9d4241d20 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
1709418535a8 KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
702ce67817de KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
15003179c74d KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
35053cdec119 KVM: x86: Defer non-architectural deliver of exception payload to userspace read
f3deabe0f5ac userfaultfd: allow registration of ranges below mmap_min_addr
14c643ecdc42 mm/damon/core: use time_in_range_open() for damos quota window start
d975c077fbdc rtc: ntxec: fix OF node reference imbalance
f92cc1d2c0b4 tpm: tpm_tis: stop transmit if retries are exhausted
2e0fd1cb4de4 tpm: tpm_tis: add error logging for data transfer
a866e2b1c65e crypto: talitos - rename first/last to first_desc/last_desc
00463d5f864a crypto: talitos - fix SEC1 32k ahash request limitation
a72815210182 arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
00b1d0f4e7bb mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
0aaa43198645 mmc: block: use single block write in retry
fdabbc881930 randomize_kstack: Maintain kstack_offset per task
c03556448d47 power: supply: axp288_charger: Do not cancel work before initializing it
703fb43600c2 LoongArch: Show CPU vulnerabilites correctly
41aec1d85b88 tpm: avoid -Wunused-but-set-variable
64282a745897 extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
4b2738b93eda libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
92e7c209036d ipv4: icmp: validate reply type before using icmp_pointers
2fd4f8b74930 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
3e75d06cf3e4 drm/arcpgu: fix device node leak
fa0c4283efef net: ks8851: Avoid excess softirq scheduling
640a7631d31d net: ks8851: Reinstate disabling of BHs around IRQ handler
f0858e1d5624 net/smc: avoid early lgr access in smc_clc_wait_msg
e98bd8888e3f net: txgbe: fix firmware version check
8fdbb6262a4a net: rds: fix MR cleanup on copy error
ff78ed177a66 net: qrtr: ns: Free the node during ctrl_cmd_bye()
4069329eeba0 tools/accounting: handle truncated taskstats netlink messages
d61482be4aae rxrpc: Fix re-decryption of RESPONSE packets
f1c6bd0cc786 rxrpc: Fix rxkad crypto unalignment handling
c4b8f32e73ea rxrpc: Fix memory leaks in rxkad_verify_response()
97a97090872f iio: adc: ad7768-1: fix one-shot mode data acquisition
528763fd6bb8 ALSA: pcmtest: Fix resource leaks in module init error paths
c21ef73713eb ALSA: pcmtest: fix reference leak on failed device registration
99c8060c3b33 ALSA: 6fire: Fix input volume change detection
f537e3ad6960 ALSA: caiaq: Handle probe errors properly
f4dfbdc1be34 ALSA: caiaq: Fix control_put() result and cache rollback
e794e1763e80 ALSA: core: Fix potential data race at fasync handling
fafab8b3cd57 io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
cf522703d4f1 io_uring/poll: fix signed comparison in io_poll_get_ownership()
89ca27d6d3b2 iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
44100ed1bdce io_uring/timeout: check unused sqe fields
2f4809a879f0 rbd: fix null-ptr-deref when device_add_disk() fails
1627d6060b45 selftests/mqueue: Fix incorrectly named file
5d1451cb2cf6 remoteproc: xlnx: Only access buffer information if IPI is buffered
c9d2f7b9c38c parisc: _llseek syscall is only available for 32-bit userspace
1b4039d8f4f6 nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
86bffea0b9f2 nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
ec7f47706269 mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
965d6162dd88 md/raid10: fix deadlock with check operation and nowait requests
222055e6b406 erofs: fix the out-of-bounds nameoff handling for trailing dirents
8555d6990432 ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
25ded535ee26 ALSA: ctxfi: Add fallback to default RSR for S/PDIF
831074ec21b4 ALSA: aoa: i2sbus: fix OF node lifetime handling
32e0b9255726 ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
0f313eb6a8f6 net: qrtr: ns: Fix use-after-free in driver remove()
3a5023627ab9 media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
4a34fd6b04f9 lib/ts_kmp: fix integer overflow in pattern length calculation
a34d96381bf8 Revert "ALSA: usb: Increase volume range that triggers a warning"
72099f015d3c PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
2209fdae5c2f media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
e9ae00490d47 net: strparser: fix skb_head leak in strp_abort_strp()
914c6456fcfc net: caif: clear client service pointer on teardown
1fbe46d2b727 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
42dc622776f3 media: amphion: Fix race between m2m job_abort and device_run
0ba03e06f037 of: unittest: fix use-after-free in testdrv_probe()
9f1cbca178c0 crypto: pcrypt - Fix handling of MAY_BACKLOG requests
9337ed5e777e f2fs: fix to detect potential corrupted nid in free_nid_list
f99165ef0677 spi: imx: fix use-after-free on unbind
8c43ed08643a um: drivers: call kernel_strrchr() explicitly in cow_user.c
cc9b6303e7ea wifi: rtw88: check for PCI upstream bridge existence
2d1f18efccdb zram: do not forget to endio for partial discard requests
108f2cd13577 LoongArch: Add spectre boundry for syscall dispatch table
29166a0e732f driver core: Don't let a device probe until it's ready
886f97fa59d0 ocfs2: split transactions in dio completion to avoid credit exhaustion
17b399cbb9fa device property: Make modifications of fwnode "flags" thread safe
abc6bdcbc045 regset: use kvzalloc() for regset_get_alloc()
e620378aab78 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
be7c5dcfd3c7 drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
c7f4dad62813 padata: Remove comment for reorder_work
a11a12a9880a padata: Fix pd UAF once and for all
0b60eb04b852 Bluetooth: MGMT: Fix possible UAFs
d0b27c41aa09 firmware: google: framebuffer: Do not mark framebuffer as busy
fd19eb1c7504 ibmasm: fix heap over-read in ibmasm_send_i2o_message()
a672682d39dd ibmasm: fix OOB reads in command_file_write due to missing size checks
fc7e9a74e322 misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
28a2e047d037 leds: qcom-lpg: Check for array overflow when selecting the high resolution
fa297e919d16 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
8775fa6e2914 ALSA: usb-audio: Evaluate packsize caps at the right place
e3a0ebd80ae6 usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
82d050713073 usb: chipidea: otg: not wait vbus drop if use role_switch
8429841d12ca usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
d1905dbbb7c0 ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
610ba605a4f7 ALSA: usb-audio: Avoid false E-MU sample-rate notifications
ab5ba9fd1387 ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
4d922539ad7d Linux 6.6.139
ff6fc65b3bf7 x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
8f907d345bae ptrace: slightly saner 'get_dumpable()' logic
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
0a40c6fbd105 Linux 6.6.141
f9957ea12103 netfs: Fix potential uninitialised var in netfs_extract_user_iter()
989214c66884 net: skbuff: propagate shared-frag marker through frag-transfer helpers
78bf6b6bb195 net: skbuff: preserve shared-frag marker during coalescing
9115669faedc net/rds: reset op_nents when zerocopy page pin fails
864889ea15f0 mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
013dcdc19615 mptcp: pm: ADD_ADDR rtx: fix potential data-race
b21823f637e0 spi: sifive: fix controller deregistration
524202b00b91 spi: sifive: Simplify clock handling with devm_clk_get_enabled()
bf76b4a58c1a media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
9c7c941d2242 spi: st-ssc4: fix controller deregistration
d8cd9fb5e655 spi: st-ssc4: switch to use modern name
a7fb771314fb ksmbd: validate inherited ACE SID length
190e570cc0fc RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
8358a142f2a1 f2fs: fix false alarm of lockdep on cp_global_sem lock
6b050c4cfade f2fs: fix incorrect file address mapping when inline inode is unwritten
f63201f674ee mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
93a9014029e4 mptcp: pm: prio: skip closed subflows
0750c7935feb mptcp: fix rx timestamp corruption on fastopen
11fdbd033e4c mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
7d7c9f0fcd19 RDMA/mana: Validate rx_hash_key_len
cc3c0a0f9657 btrfs: fix missing last_unlink_trans update when removing a directory
397418a9456c btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I()
546ca2e3e55a btrfs: use inode already stored in local variable at btrfs_rmdir()
39aba0e6d5aa smb: client: Use FullSessionKey for AES-256 encryption key derivation
cea7d2688ded drm/v3d: Reject empty multisync extension to prevent infinite loop
958e032618c8 eventfs: Use list_add_tail_rcu() for SRCU-protected children list
d2a675f2e238 btrfs: fix double free in create_space_info_sub_group() error path
1ce1ec384486 btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
707cb5df3eab pmdomain: core: Fix detach procedure for virtual devices in genpd
c7d1eb27cf37 drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
4e04b564c005 drm/gma500/oaktrail_lvds: fix hang on init failure
63a2b5906e15 drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
4eb9d07b219f drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()
e5eb0a29a8aa drm/i915: skip __i915_request_skip() for already signaled requests
2776f9016f1b iommu/vt-d: Disable DMAR for Intel Q35 IGFX
534ebc08df97 libceph: handle rbtree insertion error in decode_choose_args()
ea0d42137f0c libceph: Fix potential out-of-bounds access in crush_decode()
d7a65a34d245 libceph: Fix potential null-ptr-deref in decode_choose_args()
0d2dd7e6bb74 libceph: Fix potential out-of-bounds access in osdmap_decode()
bcbbdae1b88f netfs: fix error handling in netfs_extract_user_iter()
cad72955f8fb powerpc/warp: Fix error handling in pika_dtm_thread
d6bda9df0c0a io-wq: check that the predecessor is hashed in io_wq_remove_pending()
4bfdcefdaa60 ceph: fix a buffer leak in __ceph_setxattr()
3d3b2b01a3e7 ALSA: usb-audio: Bound MIDI endpoint descriptor scans
fafc97bd01e4 ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
7eaa514be4c0 drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
b41598bf54b3 smb/client: fix possible infinite loop and oob read in symlink_data()
a1d4f3d3c0dc ASoC: SOF: Intel: hda: Fix NULL pointer dereference
0f9ac21618c0 ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio
1eda406a9432 ASoC: SOF: Intel: hda-dai: remove dspless special case
e3ccb11fc824 netfilter: nf_tables: unconditionally bump set->nelems before insertion
dde6eca9afae KVM: x86: Fix Xen hypercall tracepoint argument assignment
a99a25db131e KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
01b71b930f15 KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
5b6da42fd804 audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
810d382802a5 net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
ecca618e1e33 netfilter: nft_ct: fix missing expect put in obj eval
151ee470edc3 audit: fix incorrect inheritable capability in CAPSET records
b92e124ef30a netfilter: nf_conntrack_sip: get helper before allocating expectation
0088b3328a6f workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
a5712dc25d14 i40e: Cleanup PTP pins on probe failure
e4c4a5074532 crypto: af_alg - Cap AEAD AD length to 0x80000000
fa6794c968d4 bonding: fix NULL pointer dereference in actor_port_prio setting
044dcbcb19c3 netconsole: avoid out-of-bounds access on empty string in trim_newline()
feb754bde3ef net/sched: sch_pie: annotate more data-races in pie_dump_stats()
bf3962084183 ksmbd: validate response sizes in ipc_validate_msg()
52b9f8099369 net: bcmgenet: fix leaking free_bds
dda1a2e898ad net: bcmgenet: Initialize u64 stats seq counter
f17a4850d1ce crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
d65a64755a3d smb: client: fix OOB reads parsing symlink error response
ba302d3abb82 smb: client: correctly handle ErrorContextData as a flexible array
2c7d07892ef8 Revert "crypto: nx - Migrate to scomp API"
6c9970847516 Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx"
cb4634cb537b Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx"
02ecc0978c45 ntfs: ->d_compare() must not block
9ccd0c1686c3 net/sched: cls_flower: revert unintended changes
131e50acfeed sfc: fix error code in efx_devlink_info_running_versions()
688f12aa4451 net: tls: fix strparser anchor skb leak on offload RX setup failure
3ad2471e61e9 ice: fix NULL pointer dereference in ice_reset_all_vfs()
bee6158b8a36 iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
b90697dd4b45 iavf: wait for PF confirmation before removing VLAN filters
5936b7f29a38 iavf: stop removing VLAN filters from PF on interface down
ee587b3b97b7 iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
3b7265b3a82f bonding: 3ad: implement proper RCU rules for port->aggregator
2353f43d7ee7 bonding: print churn state via netlink
fcf04d6f6943 bonding: add support for per-port LACP actor priority
60fcd5af8279 net: bonding: add broadcast_neighbor option for 802.3ad
ee2217012b3a bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner
71d591d33dc4 drm/amd/display: Read EDID from VBIOS embedded panel info
3dce88cf11d7 drm/amd/display: Allow DCE link encoder without AUX registers
e3f95b1ba242 futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
d68f753d89f4 ALSA: hda/conexant: Fix missing error check for jack detection
539604dcbf41 ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
35b7210e15a6 ALSA: hda/conexant: fix some typos
3eaf81c3553e netconsole: propagate device name truncation in dev_name_store()
3bc2c51a9ba1 net: netconsole: move newline trimming to function
003b52afba79 net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
a0f4e4e8e0f5 bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
0928f17e86a5 ipv6: rename and move ip6_dst_lookup_tunnel()
3bab544ae1e1 ipv4: add new arguments to udp_tunnel_dst_lookup()
f933e5a43732 ipv4: remove "proto" argument from udp_tunnel_dst_lookup()
0379c21610f0 ipv4: rename and move ip_route_output_tunnel()
5cb1dd7093d3 sctp: discard stale INIT after handshake completion
043e4b649b4b netfilter: skip recording stale or retransmitted INIT
e3610ad82ebd ASoC: codecs: ab8500: Fix casting of private data
b884ff67d62e drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
d4e0172a1b61 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
ee035a9d3eed drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
63691e396105 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
f675801889b2 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
c12a5d35033c drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
e74fc9c72c1b drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
2c6fb056567e drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
f264019be80d drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
b233ba52fd2e net: phy: dp83869: fix setting CLK_O_SEL field.
47d017fe3159 net: mctp i2c: check length before marking flow active
924b961d293c ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
9247d59ca15b neigh: let neigh_xmit take skb ownership
dbe42409bfeb neighbour: add RCU protection to neigh_tables[]
ec2501e361b0 net/sched: taprio: fix NULL pointer dereference in class dump
0d0dd383ac4d NFC: trf7970a: Ignore antenna noise when checking for RF field
17e23e815008 net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
5db090ca07b2 net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
3db8d078f7f6 vrf: Fix a potential NPD when removing a port from a VRF
d4f8505517ff net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
229ad4b2dd86 net/sched: sch_choke: annotate data-races in choke_dump_stats()
bd426bda5741 net/sched: netem: check for negative latency and jitter
5c4fe716511d net/sched: netem: fix slot delay calculation overflow
3a3698b96688 net/sched: netem: validate slot configuration
116f10027e61 net/sched: netem: only reseed PRNG when seed is explicitly provided
39a66e83ea41 net/sched: netem: fix queue limit check to include reordered packets
d2a74e0ea346 net/sched: netem: fix probability gaps in 4-state loss model
818f7673ed7f netdevsim: zero initialize struct iphdr in dummy sk_buff
47421f8401fc cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
ea6e650b079e arm64/scs: Fix potential sign extension issue of advance_loc4
b933de804c84 drm/sysfb: ofdrm: fix PCI device reference leaks
8524b1c04adc spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
ea2ecd29b8f4 netfilter: nf_conntrack_sip: don't use simple_strtoul
82664d0f1ba2 netfilter: xt_policy: fix strict mode inbound policy matching
f60bc289c555 drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
da602e831334 drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
03011db69f5e drm/amdgpu: fix spelling typos
8c4254c8f583 drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
1b8595d126ea nvme-pci: fix missed admin queue sq doorbell write
ad9973df8e0e netfilter: arp_tables: fix IEEE1394 ARP payload parsing
d7c8f95f599b nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
cbf460bf9492 tracing: branch: Fix inverted check on stat tracer registration
f8f643d5ebef btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
03d3739a830e mailbox: mailbox-test: make data_ready a per-instance variable
75a365c69bb7 mailbox: mailbox-test: initialize struct earlier
3afca89fae50 mailbox: mailbox-test: don't free the reused channel
14aed0d4e583 mailbox: add sanity check for channel array
0a0ac6cd2e46 cgroup/rdma: fix integer overflow in rdmacg_try_charge()
81c9e7e4030e mailbox: mailbox-test: free channels on probe error
0d2edd20b61b fbdev: offb: fix PCI device reference leak on probe failure
86094f62ba21 rtc: abx80x: Disable alarm feature if no interrupt attached
a11372a8b1ce fs/adfs: validate nzones in adfs_validate_bblk()
0897ccf6e930 vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
0274f24485fc tipc: fix double-free in tipc_buf_append()
0ace0ce02911 nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
6bedc3ff4ba4 net: dsa: realtek: rtl8365mb: fix mode mask calculation
d394093ed06e net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
86a6243d8654 net/sched: sch_red: annotate data-races in red_dump_stats()
717bec018ce1 net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
7bdb2b038c35 net/sched: sch_pie: annotate data-races in pie_dump_stats()
046b2d8c9606 net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
b6ba93a7b71e net/rds: zero per-item info buffer before handing it to visitors
1ff46c9915c1 ksmbd: scope conn->binding slowpath to bound sessions only
407b6e699ba8 ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
27fca12b9c2c ksmbd: destroy async_ida in ksmbd_conn_free()
8a3cd890fd2a ksmbd: add support for supplementary groups
234681c54581 ksmbd: Use struct_size() to improve smb_direct_rdma_xmit()
1f3235364037 ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
8db8727ea8d1 arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
37537e42e6df slip: bound decode() reads against the compressed packet length
c6980e8b1a86 slip: reject VJ receive packets on instances with no rstate array
5d05de2f0928 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
32e50f92c7cf netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
5241a3ab2c77 ipvs: fix MTU check for GSO packets in tunnel mode
cbeb259f3138 netfilter: xtables: restrict several matches to inet family
1c9fb8aeed06 netfilter: conntrack: remove sprintf usage
8def8fbd23f4 netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
554cc061ca13 netfilter: nft_osf: restrict it to ipv4
f9ef3db77a38 openvswitch: cap upcall PID array size and pre-size vport replies
8a5e840babc5 pppoe: drop PFC frames
d67fbc6dea5d sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
0069813e6ca9 ipv6: fix possible UAF in icmpv6_rcv()
733a1b310297 e1000e: Unroll PTP in probe error handling
8a254c6db3ee i40e: don't advertise IFF_SUPP_NOFCS
ca6f9d9aee54 ice: fix double-free of tx_buf skb
a753619ffecf ice: Remove jumbo_remove step from TX path
982a56c888d3 tcp: annotate data-races around tp->plb_rehash
993847e92765 tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
a445beb84c83 tcp: annotate data-races around tp->dsack_dups
60db862ea01e tcp: annotate data-races around tp->bytes_retrans
3e1b40e4f186 tcp: annotate data-races around tp->bytes_sent
409a02760834 tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans
eee072fe16c6 net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
aaac3bed0342 nexthop: fix IPv6 route referencing IPv4 nexthop
616db97e3aff net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys
497925275838 macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
f250c3772dd7 arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
0fa0bcdebeb0 arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
3098c905af2f arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
6d9f35fe4638 PCMCIA: Fix garbled log messages for KERN_CONT
ca962d175543 arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
7adb32513191 arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
640aea541eba arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
1f285713fb8d arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
827ccceff758 arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
eecee15e263c crypto: ccp - copy IV using skcipher ivsize
f19a744d5271 crypto: sa2ul - Fix AEAD fallback algorithm names
424df78c8a64 drm/i915/wm: Verify the correct plane DDB entry
ed5ca5d5b97c drm/i915: Loop over all active pipes in intel_mbus_dbox_update
c2577b18c6e2 drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
c5de9ff7939b drm/i915: Simplify watermark state checker calling convention
73abb7c1fffd drm/i915: Constify watermark state checker
cea15f66b7b6 f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
756d1a3954fe f2fs: Use sysfs_emit_at() to simplify code
21fe517179f3 clk: visconti: pll: initialize clk_init_data to zero
caa74d80d749 lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
db62a24a07b3 clk: qcom: dispcc-sc7180: Add missing MDSS resets
5db0537ddef4 dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
166db4ebae34 clk: xgene: Fix mapping leak in xgene_pllclk_init()
bf94322387ab clk: qoriq: avoid format string warning
4ba394f83b3c clk: imx8mq: Correct the CSI PHY sels
a778bbd3ab28 clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
0d2ba7e2e4c6 clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
235c36a86cb7 clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
081d334fe42d clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
d18b05a09142 clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
9b54ebbe5d2f clk: qcom: gcc-sc8180x: Use retention for USB power domains
a4cee425ae6b clk: qcom: gcc-sc8180x: Add missing GDSCs
9109efceb709 dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
d7aef29573c7 scsi: target: core: Fix integer overflow in UNMAP bounds check
b6007cfea4ed clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers
c5f4a211e82d scsi: sg: Resolve soft lockup issue when opening /dev/sgX
d85a906b4e51 scsi: sg: Fix sysctl sg-big-buff register during sg_init()
f9c921fd5264 scsi: sg: Make sg_sysfs_class constant
fa4e1c583c9d clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
137b5918931d RDMA/core: Prefer NLA_NUL_STRING
ba0843c19558 platform/x86: dell-wmi-sysman: bound enumeration string aggregation
622754397ac5 platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
0b11fcbe80a5 fs/ntfs3: terminate the cached volume label after UTF-8 conversion
a7fd0d0cb43f nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
ccfa51ea8a40 mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
3d0e610c43cb platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
fed8b8f33a46 tty: hvc_iucv: fix off-by-one in number of supported devices
61599d438e2d leds: lgm-sso: Remove duplicate assignments for priv->mmap
bc7998e70fa7 platform/surface: surfacepro3_button: Drop wakeup source on remove
e87c4c0095ac backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
c5be52529ad8 dev_printk: add new dev_err_probe() helpers
10bb319b0b18 i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
54dc499e5cb3 perf util: Kill die() prototype, dead for a long time
2f3548314715 ipmi: ssif_bmc: change log level to dbg in irq callback
bffedb7a72e6 ipmi: ssif_bmc: fix message desynchronization after truncated response
7d2a487c275c ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
128845823138 perf expr: Return -EINVAL for syntax error in expr__find_ids()
ea0078135c6a perf lock: Fix option value type in parse_max_stack
9bab7d2a2850 pinctrl: abx500: Fix type of 'argument' variable
92170bd2eadd perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
aceabce300c3 perf branch: Avoid incrementing NULL
8fe5240c7bd8 pinctrl: cy8c95x0: Avoid returning positive values to user space
03e71cc07cba pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
091709439f88 pinctrl: cy8c95x0: remove duplicate error message
a79fdd593c84 pinctrl: pinctrl-pic32: Fix resource leak
d216b34a9f69 bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
699e16e65962 bpf: allow UTF-8 literals in bpf_bprintf_prepare()
520454e83971 bpf: Fix NULL deref in map_kptr_match_type for scalar regs
2f954f8a04b7 bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
d0d124dbcef9 bpf, sockmap: Take state lock for af_unix iter
a94d3dd78ee8 bpf, sockmap: Fix af_unix null-ptr-deref in proto update
3cef33b9813b bpf, sockmap: Fix af_unix iter deadlock
7fd3b41260c6 bpf, arm64: Fix off-by-one in check_imm signed range check
ad4505d2ab3a HID: usbhid: fix deadlock in hid_post_reset()
5897c1dd1bfe mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
295757c3b9de mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
560c0456e613 mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
cca2c083cfcb mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
b194ae62e9e7 mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
301e85ff299b mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
2e472d2bdc14 mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
036a794e7d7f mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
fab6b870dfe6 dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
ba91de4f0f98 mtd: physmap_of_gemini: Fix disabled pinctrl state check
033939479b10 HID: asus: do not abort probe when not necessary
08c4fa3f5a9b HID: asus: make asus_resume adhere to linux kernel coding standards
5dcb51558e78 ima: check return value of crypto_shash_final() in boot aggregate
9399a9298935 tracing: Rebuild full_name on each hist_field_name() call
c258fbf57113 soundwire: cadence: Clear message complete before signaling waiting thread
0b73d5dfa3fe dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
5acbbb205a1c soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
faa66f358d30 dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
b9ae3942deec ocfs2: validate group add input before caching
bb3c54d1e715 ocfs2: validate bg_bits during freefrag scan
d919b905939e ocfs2: fix listxattr handling when the buffer is full
f1e38ba97b1a ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
064494145a70 arm64/xor: fix conflicting attributes for xor_block_template
08c073e8f8d5 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
96a30f7cb8e0 arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
ccff9145cd52 soc: qcom: aoss: compare against normalized cooling state
d672c7623306 soc: qcom: llcc: fix v1 SB syndrome register offset
819d8ebad320 ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
f37de46149db ocfs2/dlm: validate qr_numregions in dlm_match_regions()
813a47b03090 unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
39a8c0df2d5a soc/tegra: cbb: Set ERD on resume for err interrupt
b87992ddf49a arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
7d6481cf2987 arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot
03d523e50662 arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
a37e61cde05a arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
7ce6aa2eca26 arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
1563a05cf920 arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
4322d8c7af96 arm64: dts: qcom: sm8550: Fix GIC_ITS range length
97bacd872319 arm64: dts: qcom: sm8450: Fix GIC_ITS range length
1e014285a3cd soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
9f54516bce15 soc: qcom: ocmem: register reasons for probe deferrals
d45c46c0e84f soc: qcom: ocmem: use scoped device node handling to simplify error paths
1637ce361b1d soc: qcom: ocmem: make the core clock optional
2ecad03d6c5d arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
5a0dcba6178f arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
5b94fe0879bc arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
167e5fa8feee arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
fe1d1423c524 iommufd: vfio compatibility extension check for noiommu mode
700e54a2beba arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)
036f599234e4 arm64: dts: imx8-apalis: Fix LEDs name collision
cecc17692ebf memory: tegra30-emc: Fix dll_change check
7e19e72f3064 memory: tegra124-emc: Fix dll_change check
c13c938a8058 ARM: dts: mediatek: mt7623: fix efuse fallback compatible
8fcefe840fa8 ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
8be69e9245f8 efi/capsule-loader: fix incorrect sizeof in phys array reallocation
233a0945a4b1 gfs2: prevent NULL pointer dereference during unmount
bf5fcd9c37c2 gfs2: add some missing log locking
6678dde26570 quota: Fix race of dquot_scan_active() with quota deactivation
f57b68b36571 ktest: Run POST_KTEST hooks on failure and cancellation
aa6b9e38086c ktest: Honor empty per-test option overrides
5bddd0d3a926 ktest: Avoid undef warning when WARNINGS_FILE is unset
232d67974a61 gfs2: Call unlock_new_inode before d_instantiate
18216b8ab690 crypto: jitterentropy - replace long-held spinlock with mutex
f57498d2bf16 dm cache: fix missing return in invalidate_committed's error path
3a77b05ff2c4 ALSA: sc6000: Keep the programmed board state in card-private data
dcbc2e2b2434 ALSA: sc6000: Use standard print API
3e79a563377a spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
fa7881f3b627 PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
bf98711d2f33 PCI: tegra194: Use DWC IP core version
5d9c9dfef907 PCI: tegra194: Allow system suspend when the Endpoint link is not up
2c87f49f2082 PCI: tegra194: Disable direct speed change for Endpoint mode
272e9c4bcae8 PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
997122b96544 PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
39564f51567e PCI: tegra194: Don't force the device into the D0 state before L2
e81f33968542 PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0()
fdb9c5a3a627 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
8aa59b1e53a7 PCI: tegra194: Increase LTSSM poll time on surprise link down
8f26b92dc606 PCI: tegra194: Fix polling delay for L2 state
9e225563c5a9 ASoC: SOF: compress: return the configured codec from get_params
2721d23db2e9 ALSA: scarlett2: Add missing sentinel initializer field
7e805fdb16dc selftest: memcg: skip memcg_sock test if address family not supported
05a3fd57cdfa Documentation: fix a hugetlbfs reservation statement
11a810989a4d selftests/mm: skip migration tests if NUMA is unavailable
07a5ecb94768 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
0afb2eca25be PCI: Enable AtomicOps only if Root Port supports them
9f1daac27ca2 ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
5f1035ba3ed9 crypto: qat - use swab32 macro
1ac96689ce29 ASoC: qcom: qdsp6: topology: check widget type before accessing data
d39e8c3724a6 ASoC: fsl_easrc: Change the type for iec958 channel status controls
4d427d3f507a ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
a2e9527bc88e ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
4428887805ef ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
0dddb5642d64 ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
ceb388682ea1 ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
4605327fd688 ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
a6bc5432055b ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
62c4ab11840d ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
6adc82ff2f20 ASoC: fsl_micfil: Add access property for "VAD Detected"
4ba05463862c pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
3a73abb39037 pmdomain: ti: omap_prm: Fix a reference leak on device node
bad87bdd52f5 drm/msm/a6xx: Use barriers while updating HFI Q headers
98fce340ec48 drm/msm/shrinker: Fix can_block() logic
679a533d2235 drm/msm/a6xx: Fix HLSQ register dumping
f101e4ebf1fc ASoC: SOF: Intel: hda: Place check before dereference
2958b391d9c5 ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
ad08dd4476eb drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
ef1c7aaa1319 drm/amd/pm/ci: Fill DW8 fields from SMC
9e6d83f651ac drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
4cf77e3298e4 drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
37f93b3159fa drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
cc88a98c873b drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
33da7d5b6a50 drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
9a7f12105f0e ALSA: core: Validate compress device numbers without dynamic minors
0558d1b0b5f0 drm/panel: simple: Correct G190EAN01 prepare timing
c4fc7ed73a0a drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
97d360a0112e drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
af6825d3e446 drm/msm/dsi: add the missing parameter description
9830999c9e06 drm/msm/dpu: fix mismatch between power and frequency
94d99e853617 spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
8ebaa3deb04f drm/amdgpu/gfx10: look at the right prop for gfx queue priority
a6d44f477000 padata: Put CPU offline callback in ONLINE section to allow failure
0e664e99abb4 padata: Remove cpu online check from cpu add and removal
39024f54f098 crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
59fce560694d crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
60c571a7d8d0 crypto: atmel - Remove cfb and ofb
3cd5cae11afa fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
6f866e941a7e dm init: ensure device probing has finished in dm-mod.waitfor=
5af3d8f2acb6 drm/amdgpu: Add default case in DVI mode validation
ef0d045ebbaf drm/sun4i: Fix resource leaks
6040b24095a8 spi: fsl-qspi: Use reinit_completion() for repeated operations
dc97ec849559 drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check
b01a582c8c6f drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs
5302015daf26 drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()
d4ac87567f86 dm log: fix out-of-bounds write due to region_count overflow
15c30997dca6 dm cache metadata: fix memory leak on metadata abort retry
2ebe1ab83292 platform/chrome: chromeos_tbmc: Drop wakeup source on remove
12105c7f1837 dm cache: fix dirty mapping checking in passthrough mode switching
89e04987574a dm cache: support shrinking the origin device
d90accff225f dm cache: fix concurrent write failure in passthrough mode
ac5ee9944389 dm cache policy smq: fix missing locks in invalidating cache blocks
ecb10c193cbe dm cache: fix write hang in passthrough mode
ceff6df26691 dm cache: fix write path cache coherency in passthrough mode
0aa745fea1f8 dm cache: fix null-deref with concurrent writes in passthrough mode
002a5f925d42 ASoC: sti: use managed regmap_field allocations
686a6b305ec8 ASoC: sti: Return errors from regmap_field_alloc()
cf615b90a11a drm/sun4i: backend: fix error pointer dereference
d8a541906860 drm/komeda: fix integer overflow in AFBC framebuffer size check
866d3d9b8775 net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
1943e71a0d6a sctp: fix missing encap_port propagation for GSO fragments
cc4dead22ede net: phy: qcom: at803x: Use the correct bit to disable extended next page
22f22f1346b4 net: phy: move at803x PHY driver to dedicated directory
e30356c3cf2f net: phy: add Rust Asix PHY driver
014860036d1f net: phy: aquantia: move to separate directory
77a853aec710 Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
6b4d226d01ab Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
a673cf6c4ac7 Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
315acf971d75 Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
0a04db240eff bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
61a9b216ca5b net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
02c1256f1990 net/mlx5e: Fix features not applied during netdev registration
4f1ca61e5311 dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
b3682e7ad450 net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
f7361841d0ce net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
954745d0223e ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
e19c5ed9f192 bpf: Fix OOB in pcpu_init_value
07035306bf72 net/rds: Restrict use of RDS/IB to the initial network namespace
2c7883d606aa net/rds: Optimize rds_ib_laddr_check
f23424a0ddad net/sched: act_ct: Only release RCU read lock after ct_ft
e9cf4018d742 net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
f4ed5d750b4a 6pack: propagage new tty types
b1f7158a86f3 bpf: Fix RCU stall in bpf_fd_array_map_clear()
8849b50e81a2 netfilter: nft_fwd_netdev: check ttl/hl before forwarding
9ca570236cc0 netfilter: xt_socket: enable defrag after all other checks
e8206538cbaf net: bcmgenet: fix racing timeout handler
1b0865a6efce net: bcmgenet: switch to use 64bit statistics
991cd78f95f2 net: bcmgenet: support reclaiming unsent Tx packets
355b61569e84 net: bcmgenet: move DESC_INDEX flow to ring 0
df3a1bb0ae1a net: bcmgenet: add bcmgenet_has_* helpers
d650d12d58ef net: bcmgenet: Remove custom ndo_poll_controller()
2a7459017042 net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
03d97b558d80 arm64: kexec: Remove duplicate allocation for trans_pgd
0e72fd7f05ae ACPI: AGDI: fix missing newline in error message
3ff85ae79e1a bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
26b380a3ca0b bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
d3f280be48f1 wifi: brcmfmac: Fix error pointer dereference
a713b72ff88c bpf: Fix stale offload->prog pointer after constant blinding
b4b5a20bed82 bpf: fix end-of-list detection in cgroup_storage_get_next_key()
1aa61a6f42ad macvlan: annotate data-races around port->bc_queue_len_used
0adec27bde44 selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
81bc3a2ccc37 selftests/powerpc: Re-order *FLAGS to follow lib.mk
7ca35863213c powerpc/crash: fix backup region offset update to elfcorehdr
6e474972b85e r8152: fix incorrect register write to USB_UPHY_XTAL
ea04b9881534 wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()
571a05ea1baa bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
eefe0c2ea2c3 bpf, devmap: Remove unnecessary if check in for loop
6d5202409467 wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
66f2a0becd35 wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
6cf44608d5e6 arm64: cpufeature: Make PMUVer and PerfMon unsigned
63fe66f10283 wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
4dd75a78cdfb wifi: mt76: mt7915: fix use_cts_prot support
382cbdf6e484 wifi: mt76: mt7615: fix use_cts_prot support
c8e46d0664c4 wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr()
231b895daa02 module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
e6962cb18a89 params: Replace __modinit with __init_or_module
edc90a12073b s390/bpf: Zero-extend bpf prog return values and kfunc arguments
e70b9c2292cc dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
6e8d309bc69b dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
c7ad31fb948f bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap
5d81743ee3cc bpf: Add CHECKSUM_COMPLETE to bpf test progs
008c456b76e9 wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
255cc1d30f32 wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
a5af71c6181e firmware: dmi: Correct an indexing error in dmi.h
240f832a9c20 locking: Fix rwlock support in <linux/spinlock_up.h>
ca2d280b9b38 hrtimer: Reduce trace noise in hrtimer_start()
ece8be21d8c9 hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
16774f7333fc hrtimers: Update the return type of enqueue_hrtimer()
b54f14e1460c irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
c4295487124f s390/cio: use generic driver_override infrastructure
9d606425a752 s390/cio: convert sprintf()/snprintf() to sysfs_emit()
3d0cfecf4ff7 s390/cio: make sch->lock spinlock pointer a member
6325eea40a95 debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
f9c489418b8e debugfs: check for NULL pointer in debugfs_create_str()
fc6ecb4b8ef9 thermal/drivers/spear: Fix error condition for reading st,thermal-flags
f75ea8cdca54 devres: fix missing node debug info in devm_krealloc()
d172f1c8a8b3 ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
9a6f4d85a016 ACPI: x86: cmos_rtc: Clean up address space handler driver
da8255040938 pstore/ram: fix resource leak when ioremap() fails
4048ed98860d blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
b88f905d4449 nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
5dd9d864eb96 loop: fix partition scan race between udev and loop_reread_partitions()
282e06e6d494 drbd: Balance RCU calls in drbd_adm_dump_devices()
131ea3e57fc2 fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
467289e0d0f2 blk-cgroup: wait for blkcg cleanup before initializing new disk
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
924b4a879cbb Linux 6.6.142
cefa4265b111 security/keys: fix missed RCU read section on lookup
105c6a594b3f LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
1f9c82855641 net: gro: don't merge zcopy skbs
f504118252af pds_core: ensure null-termination for firmware version strings
d3f3d6fa0cad pds_core: add an error code check in pdsc_dl_info_get
01f7f893d5e1 net: mana: validate rx_req_idx to prevent out-of-bounds array access
3dee2fe0c818 ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
d798b25c24f4 gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
0f1fd5e83f0b gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
cd87492b79d1 string: add mem_is_zero() helper to check if memory area is all zeros
c9ea01768903 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
40fc66218ad1 net: ag71xx: check error for platform_get_irq
2a1905730e0c Bluetooth: btmtk: fix urb->setup_packet leak in error paths
f04578422154 Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c
73377cf3056a Bluetooth: btmtk: rename btmediatek_data
aa58d8366269 Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset
b748250d778e Bluetooth: btmtk: add the function to get the fw name
e91687643c44 tracing: Avoid NULL return from hist_field_name() on truncation
8ba1c4ddbb1c ALSA: seq: Serialize UMP output teardown with event_input
e5604a480487 ALSA: seq: ump: Use guard() for locking
b6d3d3816c67 ptrace: Convert ptrace_attach() to use lock guards
60ef1675b652 pds_core: fix debugfs_lookup dentry leak and error handling
3231aff8ab26 pds_core: fix error handling in pdsc_devcmd_wait
1900ca8acb92 bridge: mcast: Fix a possible use-after-free when removing a bridge port
6e79715b7b8a net: bridge: Flush multicast groups when snooping is disabled
00904a73272b RDMA/rtrs: Fix use-after-free in path file creation cleanup
a7685f4d90c1 platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
527a7990e663 platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
6ea1690b24e9 platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
32ba2ce2b15f platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
566f42fb67a7 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
314a94c47d28 net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
1bddf306212a net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw
d2be607d042d net: dsa: mt7530: fix FDB entries not aging out with short timeout
69a0885079c9 wifi: ath11k: fix peer resolution on rx path when peer_id=0
070e40acc59e drm/msm/snapshot: fix dumping of the unaligned regions
dd844b31f4ea spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
5c54c482934b net/mlx5: Do not restore destination-less TC rules
d65b279a1898 tls: Preserve sk_err across recvmsg() when data has been copied
1822997aa8c2 x86/xen: Fix xen_e820_swap_entry_with_ram()
06cc5ad2c112 net: phy: DP83TC811: add reading of abilities
d04494596b5e net: phy: c45: add genphy_c45_pma_read_ext_abilities() function
acdc12b71c9a net: tls: prevent chain-after-chain in plain text SG
131ef12057d9 net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
d38ba387244e net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
a09d07ac45e2 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
7256e54583ae drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
567b5e976e2e drm/msm/dsi: don't dump registers past the mapped region
b40e10c72df5 ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
720c76b930c5 net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
9baafc2fea09 accel/qaic: Add overflow check to remap_pfn_range during mmap
f775be13d342 HID: quirks: really enable the intended work around for appledisplay
a5db6a7c062f wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
3d675896ea03 wifi: ath11k: fix error path leaks in some WMI WOW calls
b77be98447c4 net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
78cf08b3be47 net: ethernet: cortina: Carry over frag counter
68c9c3ac9ce5 net: ethernet: cortina: Drop half-assembled SKB
3b249988d774 net: ethernet: cortina: Make RX SKB per-port
00efe58bbdcc netfs: Fix overrun check in netfs_extract_user_iter()
0df68fd72b2a zonefs: handle integer overflow in zonefs_fname_to_fno
eef4f71b46a9 irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
6760af11a26e irqchip/ath79-cpu: Remove unused function
6af5fd2ffda1 phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
b0cc58e8f749 net: lan966x: avoid unregistering netdev on register failure
9e1c9b957344 ice: fix locking in ice_dcb_rebuild()
07d77d774f71 tcp: Fix imbalanced icsk_accept_queue count.
08d355936fcf test_kprobes: clear kprobes between test runs
8a5f01446021 kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
99948d73a8c7 netfilter: x_tables: unregister the templates first
26b2290baaf6 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
542b49d2cf12 ALSA: hda: cs35l56: Put ACPI device after setting companion
508b1193d63b ARM: integrator: Fix early initialization
fb3ff02dd444 pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
7d694570281a kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
0df3f3031517 kunit: config: Enable KUNIT_DEBUGFS by default
8b0f4e3b7ad6 firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
adfff93d08a2 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
58ab91af4124 HID: uclogic: Fix regression of input name assignment
a2d1c819348b hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
20d626463e3f hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
cba4f1122dfb hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
6b5573b63e30 hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple
4d1da9a6be5a hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
60c4b9fe1a3d hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
d94ceb16e55b hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
f85c81e93dbd hwmon: (pmbus/adm1266) reject implausible blackbox record_count
025cfc7a09c5 hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
32edd2a28e11 batman-adv: tt: fix negative tt_buff_len
22d59c72f4a4 batman-adv: tt: fix negative last_changeset_len
c2c88736022c batman-adv: tp_meter: fix race condition in send error reporting
0b1bedf114ea batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
53f931e0146a batman-adv: tp_meter: avoid use of uninit sender vars
48663158222b batman-adv: bla: fix report_work leak on backbone_gw purge
b54e459cf869 batman-adv: frag: disallow unicast fragment in fragment
c1bac194733a batman-adv: fix tp_meter counter underflow during shutdown
f653b040dad1 batman-adv: fix fragment reassembly length accounting
866ac1d57040 batman-adv: dat: handle forward allocation error
6de089b545db batman-adv: clear current gateway during teardown
70bcb678561f batman-adv: mcast: fix use-after-free in orig_node RCU release
90c398e822ca drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
fb30a3890d62 drm/amd/display: Validate GPIO pin LUT table size before iterating
266b21b57fbb drm/amd/display: Fix integer overflow in bios_get_image()
e4d3d33ab7bd drm/bridge: megachips: remove bridge when irq request fails
25473edcdaef drm/bridge: it66121: acquire reset GPIO in probe
21ab64c77a30 drm/virtio: use uninterruptible resv lock for plane updates
371f53925a67 device property: set fwnode->secondary to NULL in fwnode_init()
fb3539b367f5 LoongArch: Remove unused code to avoid build warning
14553be882d9 RDMA/siw: Reject MPA FPDU length underflow before signed receive math
f2dc841d7dc9 spi: ti-qspi: fix use-after-free after DMA setup failure
450c319dd04d spi: sprd: fix error pointer deref after DMA setup failure
309c6058622d scsi: isci: Fix use-after-free in device removal path
9d5ae6b8d9ec phy: tegra: xusb: Fix per-pad high-speed termination calibration
45760b72e84c spi: qup: fix error pointer deref after DMA setup failure
3c83a6912c24 drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
dab9f93251b2 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
e0790046f6be arm64: probes: Handle probes on hinted conditional branch instructions
f383cff9fb38 tracing: Do not call map->ops->elt_free() if elt_alloc() fails
bdc349a87f1f cifs: Fix busy dentry used after unmounting
1ced0f5a851f wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
a3a4366731a5 ice: fix setting promisc mode while adding VID filter
add70e2682c0 ixgbevf: fix use-after-free in VEPA multicast source pruning
3c5411fa4944 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
f50c3ff97c83 wifi: ath11k: clear shared SRNG pointer state on restart
ce29d3bf79a2 vsock/virtio: reset connection on receiving queue overflow
cc27e989a5df vsock/vmci: fix UAF when peer resets connection during handshake
273a1481c556 ring-buffer: Fix reporting of missed events in iterator
3904b993cc17 qed: fix double free in qed_cxt_tables_alloc()
c161ad9157f5 netfilter: nft_inner: Fix IPv6 inner_thoff desync
c281e018af98 netfilter: ipset: stop hash:* range iteration at end
1e5e20031c5e netfilter: nf_queue: hold bridge skb->dev while queued
41ec2e242f17 netfilter: ip6t_hbh: reject oversized option lists
16bd798cb6d8 net: ifb: report ethtool stats over num_tx_queues
289499907399 net: bcmgenet: keep RBUF EEE/PM disabled
8420aa490041 phonet/pep: disable BH around forwarded sk_receive_skb()
be43e6b40431 Bluetooth: serialize accept_q access
a143ce77a529 Bluetooth: MGMT: validate Add Extended Advertising Data length
9d20d48be2c4 Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
fe69f634b076 Bluetooth: bnep: Fix UAF read of dev->name
3af41ee7ebec Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
5d86d2f1b4d9 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
6f63a60580eb net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
686b4283f82c drivers/base/memory: fix memory block reference leak in poison accounting
29cd94e678fc efi: Allocate runtime workqueue before ACPI init
7b6f8c8eb93f ALSA: asihpi: Fix potential OOB array access at reading cache
41a766c64729 ALSA: pcm: Don't setup bogus iov_iter for silencing
dade81458966 ALSA: ua101: Reject too-short USB descriptors
0dbf64c50244 hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
adcfb16ae402 smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
7df1df6f40c0 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
9d378e17c864 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
e43cb36d4d78 ksmbd: fix null pointer dereference in compare_guid_key()
082351f9d400 mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
31527d80234c sysfs: don't remove existing directory on update failure
ad7520628c74 Revert "af_unix: Reject SIOCATMARK on non-stream sockets"
f624070c322d Revert "s390/cio: Update purge function to unregister the unused subchannels"
7963b6141b4c Revert "ice: Remove jumbo_remove step from TX path"
6331b0f7b71e Revert "ice: fix double-free of tx_buf skb"
2035acfb1722 smb: client: reject userspace cifs.spnego descriptions
3106f326f67c af_unix: Give up GC if MSG_PEEK intervened.
3a436932eb39 ksmbd: close durable scavenger races against m_fp_list lookups
712cdf917e77 ksmbd: validate owner of durable handle on reconnect
7f0cb478703c ksmbd: add durable scavenger timer
50a23fa28e76 ksmbd: avoid reclaiming expired durable opens by the client
2682bf9a804b Revert "x86/vdso: Fix output operand size of RDPID"
ba5b43db126a wifi: mac80211: check tdls flag in ieee80211_tdls_oper
a052c2d8399a s390/debug: Reject zero-length input before trimming a newline
492349e5e4a3 driver core: platform: use generic driver_override infrastructure
64a3ee535bd7 driver core: generalize driver_override in struct device
fabfed1afe27 spi: spidev: fix lock inversion between spi_lock and buf_lock
6a3af482188f mptcp: pm: ADD_ADDR rtx: free sk if last
9426265e157d mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
19a3ec9ef176 mptcp: pm: ADD_ADDR rtx: allow ID 0
b386aa38b81d mptcp: sync the msk->sndbuf at accept() time
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Fix the following build failure
probes/../../include/lttng/tracepoint-event-impl.h:133:6: error: conflicting
types for 'trace_hrtimer_start'; have 'void(struct hrtimer *, enum hrtimer_mode)'
133 | void trace_##_name(_proto);
| ^~~~~~
Signed-off-by: He Zhe <zhe.he@windriver.com>
[YC: backported from wrynose commit e32cbc1 ("lttng-modules: Fix
trace_hrtimer_start build failure").
This is a partial backport of commit 7dae5f4 ("lttng-modules:
fix build against kernel 7.1+")]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Integrating the following commit(s) to linux-yocto/.:
1/1 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: genericarm64/serial: change SERIAL_IMX_CONSOLE to =y
Date: Fri, 19 Jun 2026 00:54:55 +0200
With the following upstream commit, this option is no longer
tristate, so we set it to =y instead:
commit 3f8b835a63341163da0400befb3c6e8f6d4085da
Author: Randy Dunlap <rdunlap@infradead.org>
Date: Sat Jan 10 15:26:40 2026 -0800
serial: imx: change SERIAL_IMX_CONSOLE to bool
[ Upstream commit 79527d86ba91c2d9354832d19fd12b3baa66bd10 ]
SERIAL_IMX_CONSOLE is a build option for the imx driver (SERIAL_IMX).
It does not build a separate console driver file, so it can't be built
as a module since it isn't built at all.
Change the Kconfig symbol from tristate to bool and update the help
text accordingly.
Fixes: 0db4f9b91c86 ("tty: serial: imx: enable imx serial console port as module")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260110232643.3533351-2-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
(cherry picked from commit 465cb5bcefd72f429e0b3ad6ab5b3fcff5b390fc)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Integrating the following commit(s) to linux-yocto/6.6:
1/1 [
Author: Baokun Li
Email: libaokun1@huawei.com
Subject: ext4: get rid of ppath in get_ext_path()
Date: Thu, 22 Aug 2024 10:35:32 +0800
The use of path and ppath is now very confusing, so to make the code more
readable, pass path between functions uniformly, and get rid of ppath.
After getting rid of ppath in get_ext_path(), its caller may pass an error
pointer to ext4_free_ext_path(), so it needs to teach ext4_free_ext_path()
and ext4_ext_drop_refs() to skip the error pointer. No functional changes.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20240822023545.1994557-13-libaokun@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
[YC: more detail at https://lore.kernel.org/openembedded-core/DJGKEQF8GRU1.RF7JY64COTAA@smile.fr/T/#u]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Different versions of gawk can produce different output, so depending on which version is installed on the build host, reproducibility issues can occur: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16072 So far only glibc and grub have been identified to have the issue; probably more fixes of similar nature will be required going forward. Adjust the gawk recipe to apply target-only tweaks (particularly the removal of awk symlink to allow for alternatives) to only target and nativesdk variants, so that native installs both awk and gawk executables. [YOCTO #16072] Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c5bbf0a) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
After the gawk dependency change, we need to change PR/hashequiv version to replace the corrupted sstate/hashequiv data. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f0f7632) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
When we build gawk-native it is only for use in builds where the host gawk output isn't reproducible across versions[1]. As such it doesn't need support for readline or mprf, and by removing those from gawk-native we can get building gawk-native sooner. [1] oe-core c5bbf0a ("gawk: use native gawk when building glibc and grub") Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1e6b810) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
On Ubuntu 26.04, GCC 15 defaults to std=c23 and that results in build
failure:
| ../gawk-5.3.0/io.c: In function ‘iop_alloc’:
| ../gawk-5.3.0/io.c:3389:31: error: assignment to ‘ssize_t (*)(int, void *, size_t)’ {aka ‘long int (*)(int, void *, long unsigned int)’} from incompatible pointer type ‘ssize_t (*)(void)’ {aka ‘long int (*)(void)’} [-Wincompatible-pointer-types]
| 3389 | iop->public.read_func = ( ssize_t(*)() ) read;
| | ^
Fix this by (partially) backporting an upstream patch.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] also mentioned at Debian report in [2] [1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/9e1a427d2f047439d0320defe1593e6352595788 [2] https://security-tracker.debian.org/tracker/CVE-2025-11021 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> [YC: The CVE fixing patch is d010b0bbd in 3.6.6 (current master/wrynose)] Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch from [1] also mentioned at Debian report in [2] [1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/af4bde990270b825b7d110a495cc65de9e2ec32f [2] https://security-tracker.debian.org/tracker/CVE-2026-2369 Note: Issue introduced by the fix for CVE-2025-32052. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Backport patch from [1] [1] https://go.dev/cl/783621 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [2] [1] https://lists.x.org/archives/xorg-announce/2026-April/003679.html [2] https://security-tracker.debian.org/tracker/CVE-2026-33999 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [2] [1] https://lists.x.org/archives/xorg-announce/2026-April/003679.html [2] https://security-tracker.debian.org/tracker/CVE-2026-34000 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [2] [1] https://lists.x.org/archives/xorg-announce/2026-April/003679.html [2] https://security-tracker.debian.org/tracker/CVE-2026-34001 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [2] [1] https://lists.x.org/archives/xorg-announce/2026-April/003679.html [2] https://security-tracker.debian.org/tracker/CVE-2026-34002 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Pick patch according to [2] [1] https://lists.x.org/archives/xorg-announce/2026-April/003679.html [2] https://security-tracker.debian.org/tracker/CVE-2026-34003 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
- Pick the upstream patch [1] as mentioned in [2] and [3]. - To successfully apply the fixed commit, apply the dependent commits [4], which are included in v1.0.28. [1] libusb/libusb@bc08861 [2] https://security-tracker.debian.org/tracker/CVE-2026-23679. [3] https://security-tracker.debian.org/tracker/CVE-2026-47104. [4] libusb/libusb@016a0de Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
- This patch applies the upstream fix [5] as referenced in [7]. - To successfully apply the fixed commit, apply the dependent commits [2] to [4] which are included in v2.8.6, as referenced in [7]. - Additionally, include dependent commit [1] from v2.8.3, as referenced in [8] under the [2.5.4-38.2] description, along with compilation fix commit [6] from v2.7.1 - Reference: [1] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=cd90f2925790 [2] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=7e8b36522f58 [3] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=42f01e6a78fe [4] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=51738ae56d92 [5] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=f36bd900a899 [6] https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=a2c95e4f557a [7] https://security-tracker.debian.org/tracker/CVE-2025-12801 [8] https://linux.oracle.com/errata/ELSA-2026-3940.html Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Backport patch to fix CVE-2026-4224. https://nvd.nist.gov/vuln/detail/CVE-2026-4224 Upstream fix: python/cpython@642865d Tested with ptest: Before: PASSED: 40007, FAILED: 0, SKIPPED: 1877 After: PASSED: 40006, FAILED: 0, SKIPPED: 1877 Signed-off-by: Amaury Couderc <amaury.couderc@est.tech> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Using /git/ in our urls is rather old school and not the preferred format now. Update the urls to the preferred form even if the other ones still work. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8ac7c0c) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
If a url has git. in it, assume it is likely to be a git cloneable url and should be treated as such. This allows us to switch from https://git.yoctoproject.org/git/XXX urls to the preferred https://git.yoctoproject.org/XXX form. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cedc920) Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: rfmibuild <NIBuildFarmSupport@ni.com>
usercw88
requested changes
Jul 17, 2026
There was a problem hiding this comment.
@Shreejit-03 This commit is signed by rfmibuild. Can you update the commit message to be signed by yourself
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge latest from upstream. No conflicts.
Justification
AB#3918183.
Testing
@ni/rtos