[PATCH 6.12 000/105] 6.12.49-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 6.12.49 release.
There are 105 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 24 Sep 2025 19:23:52 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.49-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Linux 6.12.49-rc1

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: remove some #defines that are only expanded once

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: simplify the variants of clamp()

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: move all the clamp() definitions after the min/max() ones

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: reduce the #define expansion of min(), max() and clamp()

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: update some comments

David Laight <David.Laight@xxxxxxxxxx>
    minmax.h: add whitespace around operators and after commas

Bruno Thomsen <bruno.thomsen@xxxxxxxxx>
    rtc: pcf2127: fix SPI command byte for PCF2131 backport

Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
    xhci: dbc: Fix full DbC transfer ring after several reconnects

Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
    xhci: dbc: decouple endpoint allocation from initialization

Niklas Neronin <niklas.neronin@xxxxxxxxxxxxxxx>
    usb: xhci: remove option to change a default ring's TRB cycle bit

Niklas Neronin <niklas.neronin@xxxxxxxxxxxxxxx>
    usb: xhci: introduce macro for ring segment list iteration

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    mptcp: pm: nl: announce deny-join-id0 flag

Hugh Dickins <hughd@xxxxxxxxxx>
    mm/gup: check ref_count instead of lru before migration

Shivank Garg <shivankg@xxxxxxx>
    mm: add folio_expected_ref_count() for reference count calculation

Sankararaman Jayaraman <sankararaman.jayaraman@xxxxxxxxxxxx>
    vmxnet3: unregister xdp rxq info in the reset path

Sean Christopherson <seanjc@xxxxxxxxxx>
    KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions

Borislav Petkov <bp@xxxxxxxxx>
    x86/bugs: KVM: Add support for SRSO_MSR_FIX

Borislav Petkov (AMD) <bp@xxxxxxxxx>
    x86/bugs: Add SRSO_USER_KERNEL_NO support

Antheas Kapenekakis <lkml@xxxxxxxxxxx>
    platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk

Antheas Kapenekakis <lkml@xxxxxxxxxxx>
    platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13

Yang Xiuwei <yangxiuwei@xxxxxxxxxx>
    io_uring: fix incorrect io_kiocb reference in io_link_skb

Stefan Metzmacher <metze@xxxxxxxxx>
    smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path

Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    crypto: af_alg - Set merge to zero early in af_alg_sendmsg

Stefan Metzmacher <metze@xxxxxxxxx>
    smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

Paulo Alcantara <pc@xxxxxxxxxxxxx>
    smb: client: fix filename matching of deferred files

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()

Qi Xi <xiqi2@xxxxxxxxxx>
    drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path

Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>
    drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ

Shuicheng Lin <shuicheng.lin@xxxxxxxxx>
    drm/xe/tile: Release kobject for the failure path

Amadeusz Sławiński <amadeuszx.slawinski@xxxxxxxxxxxxxxx>
    ASoC: Intel: catpt: Expose correct bit depth to userspace

Colin Ian King <colin.i.king@xxxxxxxxx>
    ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message

Charles Keepax <ckeepax@xxxxxxxxxxxxxxxxxxxxx>
    ASoC: wm8974: Correct PLL rate rounding

Charles Keepax <ckeepax@xxxxxxxxxxxxxxxxxxxxx>
    ASoC: wm8940: Correct typo in control name

Charles Keepax <ckeepax@xxxxxxxxxxxxxxxxxxxxx>
    ASoC: wm8940: Correct PLL rate rounding

Jens Axboe <axboe@xxxxxxxxx>
    io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check

Jens Axboe <axboe@xxxxxxxxx>
    io_uring/msg_ring: kill alloc_cache for io_kiocb allocations

Jens Axboe <axboe@xxxxxxxxx>
    io_uring: include dying ring in task_work "should cancel" state

Jens Axboe <axboe@xxxxxxxxx>
    io_uring: backport io_should_terminate_tw()

Pavel Begunkov <asml.silence@xxxxxxxxx>
    io_uring/cmd: let cmds to know about dying task

Praful Adiga <praful.adiga@xxxxxxxxx>
    ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    selftests: mptcp: avoid spurious errors on TCP disconnect

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    selftests: mptcp: connect: catch IO errors on listen side

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    mptcp: propagate shutdown to subflows when possible

Håkon Bugge <haakon.bugge@xxxxxxxxxx>
    rds: ib: Increment i_fastreg_wrs before bailing out

Hans de Goede <hansg@xxxxxxxxxx>
    net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

Ivan Lipski <ivan.lipski@xxxxxxx>
    drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put

Maciej S. Szmigiero <maciej.szmigiero@xxxxxxxxxx>
    KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active

Thomas Fourier <fourier.thomas@xxxxxxxxx>
    mmc: mvsdio: Fix dma_unmap_sg() nents value

Mohammad Rafi Shaik <mohammad.rafi.shaik@xxxxxxxxxxxxxxxx>
    ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S

Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
    ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed

Mohammad Rafi Shaik <mohammad.rafi.shaik@xxxxxxxxxxxxxxxx>
    ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface

Qu Wenruo <wqu@xxxxxxxx>
    btrfs: tree-checker: fix the incorrect inode ref size check

Vasant Hegde <vasant.hegde@xxxxxxx>
    iommu/amd/pgtbl: Fix possible race while increase page table level

Eugene Koira <eugkoira@xxxxxxxxxx>
    iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()

Tao Cui <cuitao@xxxxxxxxxx>
    LoongArch: Check the return value when creating kobj

Huacai Chen <chenhuacai@xxxxxxxxxx>
    LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled

Guangshuo Li <202321181@xxxxxxxxxxxxxxx>
    LoongArch: vDSO: Check kcalloc() result in init_vdso()

Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
    LoongArch: Fix unreliable stack for live patching

Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
    objtool/LoongArch: Mark special atomic instruction as INSN_BUG type

Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
    objtool/LoongArch: Mark types based on break immediate code

Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
    LoongArch: Update help info of ARCH_STRICT_ALIGN

Hugh Dickins <hughd@xxxxxxxxxx>
    mm: revert "mm: vmscan.c: fix OOM on swap stress test"

Li Zhe <lizhe.67@xxxxxxxxxxxxx>
    gup: optimize longterm pin_user_pages() for large folio

Mikulas Patocka <mpatocka@xxxxxxxxxx>
    dm-stripe: fix a possible integer overflow

Mikulas Patocka <mpatocka@xxxxxxxxxx>
    dm-raid: don't set io_min and io_opt for raid1

H. Nikolaus Schaller <hns@xxxxxxxxxxxxx>
    power: supply: bq27xxx: restrict no-battery detection to bq27000

H. Nikolaus Schaller <hns@xxxxxxxxxxxxx>
    power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery

Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Nathan Chancellor <nathan@xxxxxxxxxx>
    nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*

Stefan Metzmacher <metze@xxxxxxxxx>
    ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size

Namjae Jeon <linkinjeon@xxxxxxxxxx>
    ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

Kan Liang <kan.liang@xxxxxxxxxxxxxxx>
    perf/x86/intel: Fix crash in icl_update_topdown_event()

Duoming Zhou <duoming@xxxxxxxxxx>
    octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()

Duoming Zhou <duoming@xxxxxxxxxx>
    cnic: Fix use-after-free bugs in cnic_delete_task

Alexey Nepomnyashih <sdl@xxxxxxxx>
    net: liquidio: fix overflow in octeon_init_instr_queue()

Tariq Toukan <tariqt@xxxxxxxxxx>
    Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"

Jakub Kicinski <kuba@xxxxxxxxxx>
    tls: make sure to abort the stream if headers are bogus

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

Sathesh B Edara <sedara@xxxxxxxxxxx>
    octeon_ep: fix VF MAC address lifecycle handling

Hangbin Liu <liuhangbin@xxxxxxxxx>
    bonding: don't set oif to bond dev when getting NS target destination

Jianbo Liu <jianbol@xxxxxxxxxx>
    net/mlx5e: Harden uplink netdev access against device unbind

Kohei Enju <enjuk@xxxxxxxxxx>
    igc: don't fail igc_probe() on LED setup error

Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx>
    i40e: remove redundant memory barrier when cleaning Tx descs

Jacob Keller <jacob.e.keller@xxxxxxxxx>
    ice: fix Rx page leak on multi-buffer frames

Jacob Keller <jacob.e.keller@xxxxxxxxx>
    ice: store max_frame and rx_buf_len only in ice_rx_ring

Yeounsu Moon <yyyynoom@xxxxxxxxx>
    net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure

Geliang Tang <geliang@xxxxxxxxxx>
    selftests: mptcp: sockopt: fix error messages

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    mptcp: tfo: record 'deny join id0' info

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    selftests: mptcp: userspace pm: validate deny-join-id0 flag

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    mptcp: set remote_deny_join_id0 on SYN recv

Hangbin Liu <liuhangbin@xxxxxxxxx>
    bonding: set random address only when slaves already exist

Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx>
    qed: Don't collect too many protection override GRC elements

Anderson Nascimento <anderson@xxxxxxxxxxxxxxxxxx>
    net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR

Ioana Ciornei <ioana.ciornei@xxxxxxx>
    dpaa2-switch: fix buffer pool seeding for control traffic

Tiwei Bie <tiwei.btw@xxxxxxxxxxxx>
    um: Fix FD copy size in os_rcv_fd_msg()

Miaoqian Lin <linmq006@xxxxxxxxx>
    um: virtio_uml: Fix use-after-free after put_device in probe

Filipe Manana <fdmanana@xxxxxxxx>
    btrfs: fix invalid extref key setup when replaying dentry

Chen Ridong <chenridong@xxxxxxxxxx>
    cgroup: split cgroup_destroy_wq into 3 workqueues

Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
    pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch

Liao Yuanhong <liaoyuanhong@xxxxxxxx>
    wifi: mac80211: fix incorrect type for ret

Lachlan Hodges <lachlan.hodges@xxxxxxxxxxxxxx>
    wifi: mac80211: increase scan_ies_len for S1G

Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
    ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported

Christoph Hellwig <hch@xxxxxx>
    nvme: fix PI insert on write

Ajay.Kathat@xxxxxxxxxxxxx <Ajay.Kathat@xxxxxxxxxxxxx>
    wifi: wilc1000: avoid buffer overflow in WID string configuration


-------------

Diffstat:

 Documentation/admin-guide/hw-vuln/srso.rst         |  13 ++
 Documentation/netlink/specs/mptcp_pm.yaml          |   4 +-
 Makefile                                           |   4 +-
 arch/loongarch/Kconfig                             |   8 +-
 arch/loongarch/include/asm/acenv.h                 |   7 +-
 arch/loongarch/kernel/env.c                        |   2 +
 arch/loongarch/kernel/stacktrace.c                 |   3 +-
 arch/loongarch/kernel/vdso.c                       |   3 +
 arch/um/drivers/virtio_uml.c                       |   6 +-
 arch/um/os-Linux/file.c                            |   2 +-
 arch/x86/events/intel/core.c                       |   2 +-
 arch/x86/include/asm/cpufeatures.h                 |   5 +
 arch/x86/include/asm/msr-index.h                   |   1 +
 arch/x86/kernel/cpu/bugs.c                         |  28 ++-
 arch/x86/kvm/svm/svm.c                             |  68 ++++++-
 arch/x86/kvm/svm/svm.h                             |   2 +
 arch/x86/lib/msr.c                                 |   2 +
 crypto/af_alg.c                                    |  10 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  39 +++-
 drivers/gpu/drm/bridge/analogix/anx7625.c          |   6 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c    |   6 +-
 drivers/gpu/drm/xe/xe_tile_sysfs.c                 |  12 +-
 drivers/gpu/drm/xe/xe_vm.c                         |   4 +-
 drivers/iommu/amd/amd_iommu_types.h                |   1 +
 drivers/iommu/amd/io_pgtable.c                     |  25 ++-
 drivers/iommu/intel/iommu.c                        |   7 +-
 drivers/md/dm-raid.c                               |   6 +-
 drivers/md/dm-stripe.c                             |  10 +-
 drivers/mmc/host/mvsdio.c                          |   2 +-
 drivers/net/bonding/bond_main.c                    |   2 +-
 drivers/net/ethernet/broadcom/cnic.c               |   3 +-
 .../net/ethernet/cavium/liquidio/request_manager.c |   2 +-
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c        |   3 -
 drivers/net/ethernet/intel/ice/ice.h               |   3 -
 drivers/net/ethernet/intel/ice/ice_base.c          |  34 ++--
 drivers/net/ethernet/intel/ice/ice_txrx.c          |  80 ++++----
 drivers/net/ethernet/intel/ice/ice_txrx.h          |   4 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |   7 +-
 drivers/net/ethernet/intel/igc/igc.h               |   1 +
 drivers/net/ethernet/intel/igc/igc_main.c          |  12 +-
 .../ethernet/marvell/octeon_ep/octep_pfvf_mbox.c   |   3 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_ptp.c  |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   2 -
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c   |  27 ++-
 drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c  |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h |  15 +-
 drivers/net/ethernet/natsemi/ns83820.c             |  13 +-
 drivers/net/ethernet/qlogic/qed/qed_debug.c        |   7 +-
 drivers/net/vmxnet3/vmxnet3_drv.c                  |  10 +-
 drivers/net/wireless/microchip/wilc1000/wlan_cfg.c |  39 ++--
 drivers/net/wireless/microchip/wilc1000/wlan_cfg.h |   5 +-
 drivers/nvme/host/core.c                           |  18 +-
 drivers/pcmcia/omap_cf.c                           |   8 +-
 drivers/platform/x86/asus-nb-wmi.c                 |  25 ++-
 drivers/platform/x86/asus-wmi.h                    |   3 +-
 drivers/power/supply/bq27xxx_battery.c             |   4 +-
 drivers/rtc/rtc-pcf2127.c                          |  10 +-
 drivers/usb/host/xhci-dbgcap.c                     |  94 ++++++---
 drivers/usb/host/xhci-debugfs.c                    |   5 +-
 drivers/usb/host/xhci-mem.c                        |  74 +++----
 drivers/usb/host/xhci.c                            |  22 +--
 drivers/usb/host/xhci.h                            |   9 +-
 fs/btrfs/tree-checker.c                            |   4 +-
 fs/btrfs/tree-log.c                                |   2 +-
 fs/nilfs2/sysfs.c                                  |   4 +-
 fs/nilfs2/sysfs.h                                  |   8 +-
 fs/smb/client/cifsproto.h                          |   4 +-
 fs/smb/client/inode.c                              |   6 +-
 fs/smb/client/misc.c                               |  36 ++--
 fs/smb/client/smbdirect.c                          |   7 +-
 fs/smb/server/transport_rdma.c                     |  26 ++-
 include/crypto/if_alg.h                            |  10 +-
 include/linux/io_uring_types.h                     |   4 +-
 include/linux/minmax.h                             | 219 ++++++++++-----------
 include/linux/mlx5/driver.h                        |   1 +
 include/linux/mm.h                                 |  55 ++++++
 include/uapi/linux/mptcp.h                         |   2 +
 include/uapi/linux/mptcp_pm.h                      |   4 +-
 io_uring/io_uring.c                                |  12 +-
 io_uring/io_uring.h                                |  13 ++
 io_uring/kbuf.h                                    |   2 +-
 io_uring/msg_ring.c                                |  24 +--
 io_uring/notif.c                                   |   2 +-
 io_uring/poll.c                                    |   3 +-
 io_uring/timeout.c                                 |   2 +-
 io_uring/uring_cmd.c                               |   6 +-
 kernel/cgroup/cgroup.c                             |  43 +++-
 mm/gup.c                                           |  41 +++-
 mm/migrate.c                                       |  22 +--
 mm/vmscan.c                                        |   2 +-
 net/ipv4/tcp.c                                     |   5 +
 net/ipv4/tcp_ao.c                                  |   4 +-
 net/mac80211/driver-ops.h                          |   2 +-
 net/mac80211/main.c                                |   7 +-
 net/mptcp/options.c                                |   6 +-
 net/mptcp/pm_netlink.c                             |   7 +
 net/mptcp/protocol.c                               |  16 ++
 net/mptcp/subflow.c                                |   4 +
 net/rds/ib_frmr.c                                  |  20 +-
 net/rfkill/rfkill-gpio.c                           |   4 +-
 net/tls/tls.h                                      |   1 +
 net/tls/tls_strp.c                                 |  14 +-
 net/tls/tls_sw.c                                   |   3 +-
 sound/firewire/motu/motu-hwdep.c                   |   2 +-
 sound/pci/hda/patch_realtek.c                      |   1 +
 sound/soc/codecs/wm8940.c                          |   9 +-
 sound/soc/codecs/wm8974.c                          |   8 +-
 sound/soc/intel/catpt/pcm.c                        |  23 ++-
 sound/soc/qcom/qdsp6/audioreach.c                  |   1 +
 sound/soc/qcom/qdsp6/q6apm-lpass-dais.c            |   7 +-
 sound/soc/sof/intel/hda-stream.c                   |   2 +-
 tools/arch/loongarch/include/asm/inst.h            |  12 ++
 tools/objtool/arch/loongarch/decode.c              |  33 +++-
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |  11 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.c  |  16 +-
 tools/testing/selftests/net/mptcp/pm_nl_ctl.c      |   7 +
 tools/testing/selftests/net/mptcp/userspace_pm.sh  |  14 +-
 118 files changed, 1069 insertions(+), 571 deletions(-)