[PATCH 6.6 00/91] 6.6.109-rc1 review
From: Greg Kroah-Hartman
Date: Tue Sep 30 2025 - 11:21:48 EST
This is the start of the stable review cycle for the 6.6.109 release.
There are 91 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.109-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Linux 6.6.109-rc1
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: remove some #defines that are only expanded once
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: simplify the variants of clamp()
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: move all the clamp() definitions after the min/max() ones
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: reduce the #define expansion of min(), max() and clamp()
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: update some comments
David Laight <David.Laight@xxxxxxxxxx>
minmax.h: add whitespace around operators and after commas
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
minmax: fix up min3() and max3() too
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
minmax: improve macro expansion and type checking
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
minmax: don't use max() in situations that want a C constant expression
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
minmax: simplify min()/max()/clamp() implementation
Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
minmax: make generic MIN() and MAX() macros available everywhere
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: add validation for ring_len param
Justin Bronder <jsbronder@xxxxxxxxxxxxxx>
i40e: increase max descriptors for XL710
Nirmoy Das <nirmoyd@xxxxxxxxxx>
drm/ast: Use msleep instead of mdelay for edid read
Hans de Goede <hansg@xxxxxxxxxx>
gpiolib: Extend software-node support to support secondary software-nodes
Jan Kara <jack@xxxxxxx>
loop: Avoid updating block size under exclusive owner
David Hildenbrand <david@xxxxxxxxxx>
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
Kefeng Wang <wangkefeng.wang@xxxxxxxxxx>
mm: migrate_device: use more folio in migrate_device_finalize()
Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
Nathan Chancellor <nathan@xxxxxxxxxx>
s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
Thomas Zimmermann <tzimmermann@xxxxxxx>
fbcon: Fix OOB access in font allocation
Samasth Norway Ananda <samasth.norway.ananda@xxxxxxxxxx>
fbcon: fix integer overflow in fbcon_do_set_font
Jinjiang Tu <tujinjiang@xxxxxxxxxx>
mm/hugetlb: fix folio is still mapped when deleted
Eric Biggers <ebiggers@xxxxxxxxxx>
kmsan: fix out-of-bounds access to shadow memory
Zhen Ni <zhen.ni@xxxxxxxxxxxx>
afs: Fix potential null pointer dereference in afs_put_server
Nobuhiro Iwamatsu <iwamatsu@xxxxxxxxxxx>
ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
tracing: dynevent: Add a missing lockdown check on dynevent
Eric Biggers <ebiggers@xxxxxxxxxx>
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: improve VF MAC filters accounting
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: add mask to apply valid bits for itr_idx
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: add max boundary check for VF filters
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: fix validation of VF state in get resources
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: fix input validation logic for action_meta
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: fix idx validation in config queues msg
Lukasz Czapnik <lukasz.czapnik@xxxxxxxxx>
i40e: fix idx validation in i40e_validate_queue_map
Amit Chaudhari <amitchaudhari@xxxxxxx>
HID: asus: add support for missing PX series fn keys
Sang-Heon Jeon <ekffu200098@xxxxxxxxx>
smb: client: fix wrong index reference in smb2_compound_op()
Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
futex: Prevent use-after-free during requeue-PI
Zabelin Nikita <n.zabelin@xxxxxxxxxxxxxxxxx>
drm/gma500: Fix null dereference in hdmi teardown
Dan Carpenter <dan.carpenter@xxxxxxxxxx>
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
Vladimir Oltean <vladimir.oltean@xxxxxxx>
net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
Vladimir Oltean <vladimir.oltean@xxxxxxx>
net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
Martin Schiller <ms@xxxxxxxxxx>
net: dsa: lantiq_gswip: do also enable or disable cpu port
Ido Schimmel <idosch@xxxxxxxxxx>
selftests: fib_nexthops: Fix creation of non-FDB nexthops
Ido Schimmel <idosch@xxxxxxxxxx>
nexthop: Forbid FDB status change while nexthop is in a group
Jason Baron <jbaron@xxxxxxxxxx>
net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
Alok Tiwari <alok.a.tiwari@xxxxxxxxxx>
bnxt_en: correct offset handling for IPv6 destination address
Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
vhost: Take a reference on the task in struct vhost_task.
Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
Petr Malat <oss@xxxxxxxxx>
ethernet: rvu-af: Remove slash from the driver name
Stéphane Grosjean <stephane.grosjean@xxxxxxxxxxxxxxxx>
can: peak_usb: fix shift-out-of-bounds issue
Vincent Mailhol <mailhol@xxxxxxxxxx>
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@xxxxxxxxxx>
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@xxxxxxxxxx>
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@xxxxxxxxxx>
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
Leon Hwang <leon.hwang@xxxxxxxxx>
bpf: Reject bpf_timer for PREEMPT_RT
Geert Uytterhoeven <geert+renesas@xxxxxxxxx>
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
James Guan <guan_yufei@xxxxxxx>
wifi: virt_wifi: Fix page fault on connect
Stefan Metzmacher <metze@xxxxxxxxx>
smb: server: don't use delayed_work for post_recv_credits_work
Christian Loehle <christian.loehle@xxxxxxx>
cpufreq: Initialize cpufreq-based invariance before subsys
Jihed Chaibi <jihed.chaibi.dev@xxxxxxxxx>
ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
Peng Fan <peng.fan@xxxxxxx>
arm64: dts: imx8mp: Correct thermal sensor index
Hugh Dickins <hughd@xxxxxxxxxx>
mm: folio_may_be_lru_cached() unless folio_test_large()
Hugh Dickins <hughd@xxxxxxxxxx>
mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
Hugh Dickins <hughd@xxxxxxxxxx>
mm/gup: check ref_count instead of lru before migration
Shivank Garg <shivankg@xxxxxxx>
mm: add folio_expected_ref_count() for reference count calculation
David Hildenbrand <david@xxxxxxxxxx>
mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
Or Har-Toov <ohartoov@xxxxxxxxxx>
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
qaqland <anguoli@xxxxxxxxxxxxx>
ALSA: usb-audio: Add mute TLV for playback volumes on more devices
Cryolitia PukNgae <cryolitia@xxxxxxxxxxxxx>
ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
noble.yang <noble.yang@xxxxxxxxxxxxxxx>
ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
i2c: designware: Add quirk for Intel Xe
Benoît Monin <benoit.monin@xxxxxxxxxxx>
mmc: sdhci-cadence: add Mobileye eyeQ support
Jiayi Li <lijiayi@xxxxxxxxxx>
usb: core: Add 0x prefix to quirks debug output
Takashi Iwai <tiwai@xxxxxxx>
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
Chen Ni <nichen@xxxxxxxxxxx>
ALSA: usb-audio: Convert comma to semicolon
Kerem Karabay <kekrby@xxxxxxxxx>
HID: multitouch: specify that Apple Touch Bar is direct
Kerem Karabay <kekrby@xxxxxxxxx>
HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field
Kerem Karabay <kekrby@xxxxxxxxx>
HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar
Kerem Karabay <kekrby@xxxxxxxxx>
HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@xxxxxxxxxxxxx>
ALSA: usb-audio: Fix block comments in mixer_quirks
Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
firewire: core: fix overlooked update of subsystem ABI version
Alok Tiwari <alok.a.tiwari@xxxxxxxxxx>
scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
-------------
Diffstat:
Makefile | 4 +-
.../dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 +-
.../boot/dts/marvell/kirkwood-openrd-client.dts | 2 +-
arch/arm/mach-bcm/Kconfig | 1 +
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +-
arch/s390/kernel/perf_cpum_cf.c | 4 +-
arch/um/drivers/mconsole_user.c | 2 +
drivers/block/loop.c | 40 ++-
drivers/cpufreq/cpufreq.c | 20 +-
drivers/edac/skx_common.h | 1 -
drivers/firewire/core-cdev.c | 2 +-
drivers/gpio/gpiolib.c | 19 +-
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +
.../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 2 +
drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h | 14 +-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 3 +
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 +
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +-
drivers/gpu/drm/ast/ast_dp.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +-
drivers/gpu/drm/radeon/evergreen_cs.c | 2 +
drivers/hid/hid-asus.c | 3 +
drivers/hid/hid-multitouch.c | 45 +++-
drivers/hwmon/adt7475.c | 24 +-
drivers/i2c/busses/i2c-designware-platdrv.c | 7 +-
drivers/infiniband/hw/mlx5/devx.c | 1 +
drivers/input/touchscreen/cyttsp4_core.c | 2 +-
drivers/irqchip/irq-sun6i-r.c | 2 +-
drivers/media/dvb-frontends/stv0367_priv.h | 3 +
drivers/mmc/host/sdhci-cadence.c | 11 +
drivers/net/can/rcar/rcar_can.c | 8 +-
drivers/net/can/spi/hi311x.c | 1 +
drivers/net/can/sun4i_can.c | 1 +
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 +-
drivers/net/can/usb/etas_es58x/es58x_devlink.c | 2 +-
drivers/net/can/usb/mcba_usb.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
drivers/net/dsa/lantiq_gswip.c | 41 +--
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e.h | 4 +-
drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 25 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 26 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 110 ++++----
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 3 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
drivers/net/fjes/fjes_main.c | 4 +-
drivers/net/wireless/virtual/virt_wifi.c | 4 +-
drivers/nfc/pn544/i2c.c | 2 -
drivers/platform/x86/sony-laptop.c | 1 -
drivers/scsi/isci/init.c | 6 +-
.../pci/hive_isp_css_include/math_support.h | 5 -
drivers/ufs/core/ufs-mcq.c | 4 +-
drivers/usb/core/quirks.c | 2 +-
drivers/video/fbdev/core/fbcon.c | 13 +-
fs/afs/server.c | 3 +-
fs/btrfs/tree-checker.c | 2 +-
fs/hugetlbfs/inode.c | 10 +-
fs/smb/client/smb2inode.c | 2 +-
fs/smb/server/transport_rdma.c | 18 +-
include/crypto/if_alg.h | 2 +-
include/linux/compiler.h | 9 +
include/linux/minmax.h | 234 +++++++++-------
include/linux/mm.h | 55 ++++
include/linux/swap.h | 10 +
include/net/bluetooth/hci_core.h | 21 ++
kernel/bpf/verifier.c | 4 +
kernel/futex/requeue.c | 6 +-
kernel/trace/preemptirq_delay_test.c | 2 -
kernel/trace/trace_dynevent.c | 4 +
kernel/vhost_task.c | 3 +-
lib/btree.c | 1 -
lib/decompress_unlzma.c | 2 +
lib/vsprintf.c | 2 +-
mm/gup.c | 28 +-
mm/kmsan/core.c | 10 +-
mm/kmsan/kmsan_test.c | 16 ++
mm/migrate_device.c | 42 ++-
mm/mlock.c | 6 +-
mm/swap.c | 4 +-
mm/zsmalloc.c | 2 -
net/bluetooth/hci_event.c | 26 +-
net/bluetooth/hci_sync.c | 7 +
net/core/skbuff.c | 2 +-
net/ipv4/nexthop.c | 7 +
net/xfrm/xfrm_state.c | 3 +
sound/usb/mixer_quirks.c | 295 +++++++++++++++++++--
sound/usb/quirks.c | 24 +-
sound/usb/usbaudio.h | 4 +
tools/testing/selftests/mm/mremap_test.c | 2 +
tools/testing/selftests/net/fib_nexthops.sh | 12 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 2 +
93 files changed, 1031 insertions(+), 363 deletions(-)