[PATCH 5.10 000/235] 5.10.266-rc1 review
From: Greg Kroah-Hartman
Date: Thu Aug 20 2026 - 12:49:10 EST
This is the start of the stable review cycle for the 5.10.266 release.
There are 235 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Linux 5.10.266-rc1
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: fix information leak
Zhang Changzhong <zhangchangzhong@xxxxxxxxxx>
net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
i2c: smbus: Check for parent device before dereference
Robert Mader <robert.mader@xxxxxxxxxxxxx>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
Christian Brauner <brauner@xxxxxxxxxx>
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
Daming Li <d4n.for.sec@xxxxxxxxx>
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Guangguan Wang <guangguan.wang@xxxxxxxxxxxxxxxxx>
net/smc: rdma write inline if qp has sufficient inline space
Siddharth Vadapalli <s-vadapalli@xxxxxx>
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Grygorii Strashko <grygorii.strashko@xxxxxx>
net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode
Grygorii Strashko <grygorii.strashko@xxxxxx>
net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata
Grygorii Strashko <grygorii.strashko@xxxxxx>
net: ethernet: ti: am65-cpsw: move ale selection in pdata
Eric Dumazet <edumazet@xxxxxxxxxx>
af_packet: Don't send zero-byte data in tpacket_snd().
Rosen Penev <rosenp@xxxxxxxxx>
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Wei Fang <wei.fang@xxxxxxx>
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Florian Westphal <fw@xxxxxxxxx>
netfilter: ipset: fix list type element drift bug
Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
netfilter: flowtable: publish GC-visible tuple last
Alexey Velichayshiy <a.velichayshiy@xxxxxxxxx>
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Xiang Mei (Microsoft) <xmei5@xxxxxxx>
netfilter: ipset: fix refcount race between list:set GC and swap
Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
crypto: ccm - Set rfc4309 maxauthsize from child
Jon Hunter <jonathanh@xxxxxxxxxx>
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Yangyu Chen <cyy@xxxxxxxxxxxx>
net: atlantic: free stranded TX buffers on ring deinit
Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
mm/ptdump: always stabilise against page table freeing using init_mm
Hyunjung Ko <hj351016@xxxxxxxxx>
net/sched: act_gact, act_police: range check the fallback control action
Tejun Heo <tj@xxxxxxxxxx>
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Baul Lee <baul.lee@xxxxxxxx>
ALSA: usx2y: bound the hwdep mmap fault offset
Takashi Iwai <tiwai@xxxxxxx>
ALSA: usx2y: Fix potential leaks of uninitialized memory
Yang Wang <kevinyang.wang@xxxxxxx>
drm/amd/pm: fix torn gpu metrics reads
Hongyan Xu <getshell@xxxxxxxxxx>
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
Christian Brauner <brauner@xxxxxxxxxx>
binfmt_misc: restore write access when removing an entry
Amir Goldstein <amir73il@xxxxxxxxx>
fs: don't block write during exec on pre-content watched files
Amir Goldstein <amir73il@xxxxxxxxx>
fsnotify: opt-in for permission events at file open time
Jonas Gorski <jonas.gorski@xxxxxxxx>
i2c: iproc: reset bus after timeout if START_BUSY is stuck
Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx>
i2c: bcm-iproc: remove printout on handled timeouts
Dawei Feng <dawei.feng@xxxxxxxxxx>
ice: fix memory leak in ice_lbtest_prepare_rings()
Dawid Osuchowski <dawid.osuchowski@xxxxxxxxxxxxxxx>
ice: fix VF interrupts cleanup
Ibrahim Hashimov <security@xxxxxxxxxxxx>
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Damien Le Moal <damien.lemoal@xxxxxxxxxxxxxxxxxx>
scsi: scsi_debug: Rename zone type constants
Damien Le Moal <damien.lemoal@xxxxxxxxxxxxxxxxxx>
scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
Damien Le Moal <damien.lemoal@xxxxxxxxxxxxxxxxxx>
scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
Bart Van Assche <bvanassche@xxxxxxx>
scsi: sd: sd_zbc: Improve source code documentation
Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
net: pktgen: fix proc entry use-after-free
Peter Seiderer <ps.report@xxxxxxx>
net: pktgen: fix code style (WARNING: Block comments)
Gregory Price <gourry@xxxxxxxxxx>
mm/vmstat: fold stranded per-cpu node stats when a node comes online
Sangho Lee <kudo3228@xxxxxxxxx>
Bluetooth: HIDP: reject frames without a transaction header
Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
skbuff: introduce skb_pull_data
Tengda Wu <wutengda@xxxxxxxxxxxxxxx>
ftrace: Add global mutex to serialize trace_parser access
Christian Brauner <brauner@xxxxxxxxxx>
super: fix emergency thaw deadlock on frozen block devices
Shiming Cheng <shiming.cheng@xxxxxxxxxxxx>
net: gro: fix double aggregation of flush-marked skbs
Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
net/sched: serialize qdisc_rtab_list against concurrent get/put
Max Kellermann <max.kellermann@xxxxxxxxx>
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
Xiubo Li <xiubli@xxxxxxxxxx>
ceph: rename _to_client() to _to_fs_client()
Xiubo Li <xiubli@xxxxxxxxxx>
libceph: add doutc and *_client debug macros support
Pavitra Jha <jhapavitra98@xxxxxxxxx>
libceph: fix two unsafe bare decodes in decode_lockers()
Xiang Mei <xmei5@xxxxxxx>
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
libceph: Amend checking to fix `make W=1` build breakage
Max Kellermann <max.kellermann@xxxxxxxxx>
ceph: avoid fs reclaim while using current->journal_info
Zhiling Zou <roxy520tt@xxxxxxxxx>
sctp: avoid auth_enable sysctl UAF during netns teardown
Chenguang Zhao <zhaochenguang@xxxxxxxxxx>
mptcp: decrement subflows counter on failed passive join
Paolo Abeni <pabeni@xxxxxxxxxx>
mptcp: fix subflow accounting on close
Hugo Villeneuve <hvilleneuve@xxxxxxxxxxxx>
serial: sc16is7xx: implement gpio get_direction() callback
Hugo Villeneuve <hvilleneuve@xxxxxxxxxxxx>
serial: sc16is7xx: fix regression with GPIO configuration
Hugo Villeneuve <hvilleneuve@xxxxxxxxxxxx>
serial: sc16is7xx: remove obsolete out_thread label
Ilpo Järvinen <ilpo.jarvinen@xxxxxxxxxxxxxxx>
serial: sc16is7xx: Fill in rs485_supported
Tomasz Moń <tomasz.mon@xxxxxxxxxxxxxxx>
sc16is7xx: Properly resume TX after stop
Michael Bommarito <michael.bommarito@xxxxxxxxx>
mptcp: only set DATA_FIN when a mapping is present
Jiangshan Yi <yijiangshan@xxxxxxxxxx>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
serial: 8250_mid: Remove unneeded test for ->setup() presence
Norbert Szetei <norbert@xxxxxxxxxxxx>
ALSA: seq: close a re-opened queue timer in the destructor
Fan Wu <fanwu01@xxxxxxxxxx>
wifi: brcmfmac: drain bus_reset work on device removal
Mirela Rabulea <mirela.rabulea@xxxxxxx>
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
media: v4l: async: Set owner for async sub-devices
Daniel Hodges <git@xxxxxxxxxxxxxxxx>
wifi: ath6kl: fix use-after-free in aggr_reset_state()
Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
media: imx219: Fix maximum frame length in lines
Jai Luthra <jai.luthra@xxxxxxxxxxxxxxxx>
media: i2c: imx219: Rename VTS to FRM_LENGTH
David Plowman <david.plowman@xxxxxxxxxxxxxxx>
media: i2c: imx219: Correct the minimum vblanking value
Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
media: i2c: imx219: Drop IMX219_VTS_* macros
Guangshuo Li <lgs201920130244@xxxxxxxxx>
media: marvell-cam: fix missing pci_disable_device() on remove
Jani Nikula <jani.nikula@xxxxxxxxx>
drm/i915/hdcp: require monotonically increasing seq_num_v
David Carlier <devnexen@xxxxxxxxx>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
drm/virtio: bound EDID block reads to the response buffer
Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
drm/virtio: Return proper error codes instead of -1
Thomas Zimmermann <tzimmermann@xxxxxxx>
drm/tegra: fbdev: Remove offset into framebuffer memory
Jani Nikula <jani.nikula@xxxxxxxxx>
drm/displayid: fix Tiled Display Topology ID size
Deepanshu Kartikey <kartikey406@xxxxxxxxx>
drm/virtio: use uninterruptible resv lock for plane updates
Christian König <christian.koenig@xxxxxxx>
dma-buf/drivers: make reserving a shared slot mandatory v4
Ashutosh Desai <ashutoshdesai993@xxxxxxxxx>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Ashutosh Desai <ashutoshdesai993@xxxxxxxxx>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Cen Zhang <zzzccc427@xxxxxxxxx>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
Ashutosh Desai <ashutoshdesai993@xxxxxxxxx>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Venkatesh Srinivas <venkateshs@xxxxxxxxxxxx>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
David Matlack <dmatlack@xxxxxxxxxx>
KVM: Introduce vcpu->wants_to_run
Sean Christopherson <seanjc@xxxxxxxxxx>
KVM: x86: Move "apicv_active" into "struct kvm_lapic"
Sean Christopherson <seanjc@xxxxxxxxxx>
KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield
Sean Christopherson <seanjc@xxxxxxxxxx>
KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: fix data loss on receive throttling
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: clean up comments and whitespace
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: add write-fifo support
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: fix write implementation
Johan Hovold <johan@xxxxxxxxxx>
USB: serial: keyspan_pda: refactor write-room handling
Fan Wu <fanwu01@xxxxxxxxxx>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Chunfeng Yun <chunfeng.yun@xxxxxxxxxxxx>
usb: gadget: bdc: fix checkpatch.pl spacing error
Reinette Chatre <reinette.chatre@xxxxxxxxx>
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
Dawei Feng <dawei.feng@xxxxxxxxxx>
octeontx2-pf: fix SQB pointer leak on init failure
Haoxiang Li <haoxiang_li2024@xxxxxxx>
net: ipa: fix SMEM state handle leaks in SMP2P init
Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
espintcp: use sk_msg_free_partial to fix partial send
Breno Leitao <leitao@xxxxxxxxxx>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
Breno Leitao <leitao@xxxxxxxxxx>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
bootconfig: do not put quotes on cmdline items unless necessary
Runyu Xiao <runyu.xiao@xxxxxxxxxx>
gpio: tegra: do not call pinctrl for GPIO direction
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Vladimir Oltean <vladimir.oltean@xxxxxxx>
net/sched: taprio: avoid calling child->ops->dequeue(child) twice
Maoyi Xie <maoyixie.tju@xxxxxxxxx>
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@xxxxxxxxx>
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
Liu Jian <liujian56@xxxxxxxxxx>
net: Add helper function to parse netlink msg of ip_tunnel_encap
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: ims-pcu - fix firmware leak in async update
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
firmware_loader: introduce __free() cleanup hanler
Guangshuo Li <lgs201920130244@xxxxxxxxx>
mmc: vub300: fix use-after-free on probe failure
Johan Hovold <johan@xxxxxxxxxx>
mmc: vub300: rename probe error labels
Johan Hovold <johan@xxxxxxxxxx>
mmc: vub300: fix use-after-free on disconnect
Maoyi Xie <maoyixie.tju@xxxxxxxxx>
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: ims-pcu - fix race condition in reset_device sysfs callback
Mikulas Patocka <mpatocka@xxxxxxxxxx>
dm-verity: make error counter atomic
Mikulas Patocka <mpatocka@xxxxxxxxxx>
dm-integrity: don't increment hash_offset twice
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
Maurizio Lombardi <mlombard@xxxxxxxxxx>
scsi: target: core: Generate correct identifiers for PR OUT transport IDs
Chaitanya Kulkarni <chaitanya.kulkarni@xxxxxxx>
scsi: target: core: pr: Initialize arrays at declaration time
Souvik Banerjee <souvik@xxxxxxxxxxxx>
ovl: use linked upper dentry in copy-up tmpfile
Abdun Nihaal <nihaal@xxxxxxxxxxxxxx>
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
Michael Bommarito <michael.bommarito@xxxxxxxxx>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx>
thunderbolt: Remove XDomain from the bus without holding tb->lock
Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx>
thunderbolt: Keep XDomain reference during the lifetime of a service
Vincent Jardin <vjardin@xxxxxxx>
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Stefan Eichenberger <stefan.eichenberger@xxxxxxxxxxx>
i2c: imx: separate atomic, dma and non-dma use case
Frank Li <Frank.Li@xxxxxxx>
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
Frank Li <Frank.Li@xxxxxxx>
dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
Gustavo Pimentel <Gustavo.Pimentel@xxxxxxxxxxxx>
dmaengine: dw-edma: Improve the linked list and data blocks definition
Gustavo Pimentel <Gustavo.Pimentel@xxxxxxxxxxxx>
PCI: Add pci_find_vsec_capability() to find a specific VSEC
Jarkko Sakkinen <jarkko@xxxxxxxxxx>
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
Fredric Cover <fredric.cover.lkernel@xxxxxxxxx>
smb: client: use kvzalloc() for megabyte buffer in simple fallocate
Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
mtd: spi-nor: swp: Improve locking user experience
Michael Walle <mwalle@xxxxxxxxxx>
mtd: spi-nor: Fix spi_nor_try_unlock_all()
Tudor Ambarus <tudor.ambarus@xxxxxxxxxxxxx>
mtd: spi-nor: Move Software Write Protection logic out of the core
Michael Walle <michael@xxxxxxxx>
mtd: spi-nor: intel: remove global protection flag
Michael Walle <michael@xxxxxxxx>
mtd: spi-nor: sst: remove global protection flag
Yiyang Chen <cyyzero16@xxxxxxxxx>
taskstats: retain dead thread stats in TGID queries
Oleg Nesterov <oleg@xxxxxxxxxx>
taskstats: fill_stats_for_tgid: use for_each_thread()
Maoyi Xie <maoyixie.tju@xxxxxxxxx>
net: thunderbolt: Fix frags[] overflow by bounding frame_count
Florian Fuchs <fuchsfl@xxxxxxxxx>
mtd: maps: vmu-flash: fix fault in unaligned fixup
Breno Leitao <leitao@xxxxxxxxxx>
9p: skip nlink update in cacheless mode to fix WARN_ON
Vasiliy Kovalev <kovalev@xxxxxxxxxxxx>
net/9p: fix infinite loop in p9_client_rpc on fatal signal
Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
lsm: infrastructure management of the sock security
Ondrej Mosnacek <omosnace@xxxxxxxxxx>
lsm: use default hook return value in call_int_hook()
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: merge deactivate helper into caller
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
Florian Westphal <fw@xxxxxxxxx>
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
Junrui Luo <moonafterrain@xxxxxxxxxxx>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
Harshad Shirwadkar <harshadshirwadkar@xxxxxxxxx>
jbd2: add a helper to find out number of fast commit blocks
Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Florian Westphal <fw@xxxxxxxxx>
netfilter: nf_conntrack_sip: remove net variable shadowing
Runyu Xiao <runyu.xiao@xxxxxxxxxx>
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
Cássio Gabriel <cassiogabrielcontato@xxxxxxxxx>
ASoC: mediatek: mt8183: Check runtime resume during probe
Runyu Xiao <runyu.xiao@xxxxxxxxxx>
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
Subbaraya Sundeep <sbhatta@xxxxxxxxxxx>
octeontx2: Annotate mmio regions as __iomem
Wentao Liang <vulab@xxxxxxxxxxx>
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
Petr Machata <petrm@xxxxxxxxxx>
mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
Ido Schimmel <idosch@xxxxxxxxxx>
mlxsw: spectrum: Apply RIF configuration when joining a LAG
David Howells <dhowells@xxxxxxxxxx>
rxrpc: Fix socket notification race
David Howells <dhowells@xxxxxxxxxx>
rxrpc: Fix notification vs call-release vs recvmsg
David Howells <dhowells@xxxxxxxxxx>
rxrpc: Fix recv-recv race of completed call
Li Xiasong <lixiasong1@xxxxxxxxxx>
tipc: restrict socket queue dumps in enqueue tracepoints
Li Daming <d4n.for.sec@xxxxxxxxx>
rxrpc: serialize kernel accept preallocation with socket teardown
Tapio Reijonen <tapio.reijonen@xxxxxxxxxxx>
serial: max310x: implement gpio_chip::get_direction()
Hugo Villeneuve <hvilleneuve@xxxxxxxxxxxx>
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
Xu Rao <raoxu@xxxxxxxxxxxxx>
ALSA: hda: Fix cached processing coefficient verbs
Ricardo Robaina <rrobaina@xxxxxxxxxx>
audit: fix recursive locking deadlock in audit_dupe_exe()
Ricardo Robaina <rrobaina@xxxxxxxxxx>
audit: use 'unsigned int' instead of 'unsigned'
Jeff Layton <jlayton@xxxxxxxxxx>
audit: widen ino fields to u64
NeilBrown <neil@xxxxxxxxxx>
VFS/audit: introduce kern_path_parent() for audit
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
Input: mms114 - reject an oversized device packet size
Zhenhao Wan <whi4ed0g@xxxxxxxxx>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Akhil R <akhilrajeev@xxxxxxxxxx>
i2c: smbus: Use device_*() functions instead of of_*()
Akhil R <akhilrajeev@xxxxxxxxxx>
device property: Add fwnode_irq_get_byname
Haoxiang Li <haoxiang_li2024@xxxxxxx>
i2c: davinci: Unregister cpufreq notifier on probe failure
Sebastian Alba Vives <sebasjosue84@xxxxxxxxx>
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Mikhail Gavrilov <mikhail.v.gavrilov@xxxxxxxxx>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Jason Gunthorpe <jgg@xxxxxxxx>
udmabuf: Do not create malformed scatterlists
Matt Bobrowski <mattbobrowski@xxxxxxxxxx>
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Chao Yu <chao@xxxxxxxxxx>
f2fs: fix UAF issue in f2fs_merge_page_bio()
Xiang Mei <xmei5@xxxxxxx>
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
Christoph Hellwig <hch@xxxxxx>
xfs: check v5 superblock features early
David Rosca <david.rosca@xxxxxxx>
drm/amdgpu: Fix UVD decode image min size calculation
David Rosca <david.rosca@xxxxxxx>
drm/amdgpu: Implement insert_end for VCE 3
David Rosca <david.rosca@xxxxxxx>
drm/amdgpu: Reject UVD message with dimensions above 4096
Candice Li <candice.li@xxxxxxx>
drm/amdgpu: validate GEM_CREATE domain combinations
David Rosca <david.rosca@xxxxxxx>
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Eric Farman <farman@xxxxxxxxxxxxx>
s390/vfio_ccw: Fix out of bounds check on CCW array
Guangshuo Li <lgs201920130244@xxxxxxxxx>
drm/radeon: fix autosuspend cleanup during teardown
Pei Xiao <xiaopei01@xxxxxxxxxx>
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
Haibo Chen <haibo.chen@xxxxxxx>
mmc: sdhci: make tuning_err a signed int
Myeonghun Pak <mhun512@xxxxxxxxx>
mmc: sdhci: unmap the bounce buffer before device release
Zhan Xusheng <zhanxusheng1024@xxxxxxxxx>
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
Yiming Zhu <zhuyiming@xxxxxxxxxxxx>
ceph: fix MDS random selection readiness predicate
Raphael Zimmer <raphael.zimmer@xxxxxxxxxxxxx>
libceph: Avoid using invalid osd indices from primary_temp
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: sur40 - fix V4L error path cleanup
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: sur40 - fix input device registration ordering
Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>
openrisc: signal: do not restore privileged SR bits on sigreturn
Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Pavitra Jha <jhapavitra98@xxxxxxxxx>
libceph: fix multiple unsafe decodes in decode_locker()
Thorsten Blum <thorsten.blum@xxxxxxxxx>
crypto: qce - fix error path in devm_qce_register_algs
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: synaptics-rmi4 - zero report size on F54 work error
George Wilson <gcwilson@xxxxxxxxxxxxx>
powerpc/pseries: lparcfg - fix kbuf[] underflow
Pengpeng Hou <pengpeng@xxxxxxxxxxx>
Input: iforce - validate input packet lengths
Zhefu Zhang <a723356@xxxxxxxxx>
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Linmao Li <lilinmao@xxxxxxxxxx>
Input: psxpad-spi - set driver data before use
Richard Davies <richard@xxxxxxxxxxxx>
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
George Wilson <gcwilson@xxxxxxxxxxxxx>
powerpc/pseries: pci - logic bug
Peter Ujfalusi <peter.ujfalusi@xxxxxxxxxxxxxxx>
ASoC: cs4265: sort the register default table
Hidayath Khan <hidayath@xxxxxxxxxxxxx>
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
mptcp: options: reset DSS fields in case of unexpected size
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
selinux: do not cancel a policy conversion that never started
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
selinux: reject a class permission count below its inherited common
Bryam Vargas <hexlabsecurity@xxxxxxxxx>
selinux: require every boolean value to be defined
Yizhou Zhao <zhaoyz24@xxxxxxxxxxxxxxxxxxxxx>
ipvs: separate destination availability state
Jiasheng Jiang <jiashengjiangcool@xxxxxxxxx>
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
Fullway Wang <fullwaywang@xxxxxxxxxxx>
media: mtk-vcodec: potential null pointer deference in SCP
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 +
arch/arm64/kvm/arm.c | 2 +-
arch/mips/kvm/mips.c | 2 +-
arch/openrisc/include/asm/processor.h | 2 +
arch/openrisc/kernel/signal.c | 5 +-
arch/powerpc/kvm/powerpc.c | 2 +-
arch/powerpc/platforms/pseries/lparcfg.c | 2 +-
arch/powerpc/platforms/pseries/pci.c | 2 +-
arch/s390/kvm/kvm-s390.c | 2 +-
arch/x86/include/asm/kvm_host.h | 3 +-
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +-
arch/x86/kvm/lapic.c | 41 +-
arch/x86/kvm/lapic.h | 3 +-
arch/x86/kvm/svm/avic.c | 4 +-
arch/x86/kvm/svm/svm.h | 2 +-
arch/x86/kvm/vmx/vmx.c | 9 +-
arch/x86/kvm/x86.c | 19 +-
crypto/ccm.c | 2 +-
drivers/base/property.c | 29 ++
drivers/char/tpm/tpm_tis_core.c | 38 +-
drivers/crypto/qce/core.c | 2 +-
drivers/dma-buf/dma-resv.c | 8 +-
drivers/dma-buf/udmabuf.c | 21 +-
drivers/dma/dw-edma/dw-edma-core.c | 77 ++--
drivers/dma/dw-edma/dw-edma-core.h | 20 +-
drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++--
drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++--
drivers/fpga/dfl-afu-main.c | 3 +
drivers/gpio/gpio-tegra.c | 18 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 +
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +-
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +-
drivers/gpu/drm/drm_connector.c | 12 +-
drivers/gpu/drm/drm_dp_mst_topology.c | 32 +-
drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +-
drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +-
drivers/gpu/drm/i915/i915_vma.c | 2 +-
drivers/gpu/drm/lima/lima_gem.c | 2 +-
drivers/gpu/drm/msm/msm_gem_submit.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
drivers/gpu/drm/qxl/qxl_release.c | 2 +-
drivers/gpu/drm/radeon/radeon_kms.c | 1 +
drivers/gpu/drm/radeon/radeon_vm.c | 2 +-
drivers/gpu/drm/tegra/fb.c | 8 +-
drivers/gpu/drm/ttm/ttm_bo.c | 4 +-
drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +-
drivers/gpu/drm/vc4/vc4_gem.c | 2 +-
drivers/gpu/drm/vgem/vgem_fence.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_drv.h | 1 +
drivers/gpu/drm/virtio/virtgpu_gem.c | 17 +
drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +-
drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +-
drivers/hwmon/npcm750-pwm-fan.c | 11 +
drivers/i2c/busses/i2c-bcm-iproc.c | 11 +-
drivers/i2c/busses/i2c-davinci.c | 4 +-
drivers/i2c/busses/i2c-imx.c | 126 +++--
drivers/i2c/i2c-core-base.c | 2 +-
drivers/i2c/i2c-core-smbus.c | 15 +-
drivers/i2c/i2c-smbus.c | 5 +-
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +-
drivers/input/joystick/iforce/iforce-packets.c | 11 +-
drivers/input/joystick/iforce/iforce-usb.c | 3 +
drivers/input/joystick/psxpad-spi.c | 1 +
drivers/input/keyboard/atkbd.c | 8 +
drivers/input/misc/ims-pcu.c | 7 +-
drivers/input/mouse/focaltech.c | 2 +-
drivers/input/rmi4/rmi_f54.c | 43 +-
drivers/input/rmi4/rmi_f55.c | 4 +-
drivers/input/touchscreen/mms114.c | 6 +
drivers/input/touchscreen/sur40.c | 23 +-
drivers/md/dm-integrity.c | 4 -
drivers/md/dm-verity-target.c | 12 +-
drivers/md/dm-verity.h | 2 +-
drivers/media/i2c/imx219.c | 47 +-
drivers/media/platform/aspeed-video.c | 1 +
drivers/media/platform/marvell-ccic/cafe-driver.c | 1 +
.../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 +
drivers/media/v4l2-core/v4l2-async.c | 8 +-
drivers/media/v4l2-core/v4l2-fwnode.c | 7 +-
drivers/mmc/host/atmel-mci.c | 2 +
drivers/mmc/host/omap_hsmmc.c | 2 +-
drivers/mmc/host/sdhci.c | 16 +
drivers/mmc/host/sdhci.h | 2 +-
drivers/mmc/host/vub300.c | 36 +-
drivers/mtd/maps/vmu-flash.c | 8 +-
drivers/mtd/spi-nor/Makefile | 2 +-
drivers/mtd/spi-nor/core.c | 406 +----------------
drivers/mtd/spi-nor/core.h | 5 +
drivers/mtd/spi-nor/intel.c | 16 +-
drivers/mtd/spi-nor/sst.c | 30 +-
drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++
drivers/net/can/usb/gs_usb.c | 2 +-
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 +
drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 +
drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +-
drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +-
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++-
drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 +
.../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +-
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++--
drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 +
drivers/net/ipa/ipa_smp2p.c | 30 +-
drivers/net/thunderbolt.c | 8 +-
drivers/net/wireless/ath/ath6kl/txrx.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 +
.../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 +
.../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 +
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/pci/pci.c | 30 ++
drivers/s390/cio/vfio_ccw_cp.c | 17 +-
drivers/s390/net/qeth_core_main.c | 3 +
drivers/s390/net/qeth_l3_main.c | 5 +
drivers/scsi/lpfc/lpfc_init.c | 3 +-
drivers/scsi/scsi_debug.c | 27 +-
drivers/scsi/sd.h | 5 +-
drivers/scsi/sd_zbc.c | 79 +++-
drivers/target/target_core_fabric_lib.c | 146 ++++--
drivers/target/target_core_internal.h | 5 +-
drivers/target/target_core_pr.c | 54 +--
drivers/thunderbolt/domain.c | 30 ++
drivers/thunderbolt/icm.c | 5 +
drivers/thunderbolt/switch.c | 14 +
drivers/thunderbolt/tb.c | 58 +--
drivers/thunderbolt/tb.h | 2 +
drivers/thunderbolt/xdomain.c | 71 ++-
drivers/tty/serial/8250/8250_mid.c | 6 +-
drivers/tty/serial/max310x.c | 20 +-
drivers/tty/serial/sc16is7xx.c | 192 ++++++--
drivers/usb/gadget/function/f_tcm.c | 192 ++++++--
drivers/usb/gadget/function/tcm.h | 13 +
drivers/usb/gadget/udc/bdc/bdc_core.c | 20 +
drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +-
drivers/usb/serial/keyspan_pda.c | 471 ++++++++++---------
fs/9p/vfs_inode.c | 9 +
fs/binfmt_elf.c | 4 +-
fs/binfmt_elf_fdpic.c | 4 +-
fs/binfmt_misc.c | 14 +-
fs/ceph/addr.c | 24 +-
fs/ceph/cache.c | 2 +-
fs/ceph/caps.c | 53 ++-
fs/ceph/dir.c | 20 +-
fs/ceph/export.c | 10 +-
fs/ceph/file.c | 33 +-
fs/ceph/inode.c | 20 +-
fs/ceph/ioctl.c | 8 +-
fs/ceph/mds_client.c | 11 +
fs/ceph/mds_client.h | 2 +
fs/ceph/mdsmap.c | 2 +-
fs/ceph/super.c | 22 +-
fs/ceph/super.h | 8 +-
fs/ceph/xattr.c | 8 +-
fs/cifs/smb2ops.c | 4 +-
fs/exec.c | 6 +-
fs/f2fs/data.c | 2 +-
fs/jbd2/journal.c | 10 +-
fs/namei.c | 42 ++
fs/overlayfs/copy_up.c | 14 +-
fs/super.c | 19 +-
fs/xfs/libxfs/xfs_sb.c | 4 +-
include/drm/drm_connector.h | 6 +-
include/drm/drm_displayid.h | 2 +-
include/linux/audit.h | 18 +-
include/linux/bootconfig.h | 3 +
include/linux/bpf_lsm.h | 4 +
include/linux/ceph/ceph_debug.h | 38 ++
include/linux/dma-resv.h | 2 +-
include/linux/dma/edma.h | 2 -
include/linux/firmware.h | 3 +
include/linux/fs.h | 28 ++
include/linux/i2c-smbus.h | 6 +-
include/linux/jbd2.h | 9 +-
include/linux/kvm_host.h | 1 +
include/linux/lsm_hooks.h | 1 +
include/linux/namei.h | 1 +
include/linux/pci.h | 1 +
include/linux/property.h | 1 +
include/linux/skbuff.h | 2 +
include/linux/thunderbolt.h | 3 +
include/media/v4l2-async.h | 9 +-
include/net/act_api.h | 20 +
include/net/ip_tunnels.h | 3 +
include/net/ip_vs.h | 7 +
include/trace/events/rxrpc.h | 2 +
include/uapi/linux/ip_vs.h | 6 -
init/main.c | 39 --
kernel/audit.c | 2 +-
kernel/audit.h | 32 +-
kernel/audit_fsnotify.c | 39 +-
kernel/audit_tree.c | 2 +-
kernel/audit_watch.c | 42 +-
kernel/auditfilter.c | 17 +-
kernel/auditsc.c | 6 +-
kernel/bpf/bpf_inode_storage.c | 10 +
kernel/sched/psi.c | 6 +
kernel/taskstats.c | 67 +--
kernel/trace/ftrace.c | 21 +-
lib/bootconfig.c | 65 +++
lib/compat_audit.c | 12 +-
mm/memory_hotplug.c | 15 +-
mm/pagewalk.c | 8 +
mm/ptdump.c | 7 +
net/9p/client.c | 2 +
net/bluetooth/hidp/core.c | 25 +-
net/ceph/cls_lock_client.c | 21 +-
net/ceph/osdmap.c | 9 +-
net/core/pktgen.c | 43 +-
net/core/skbuff.c | 28 +-
net/ipv4/ip_tunnel_core.c | 35 ++
net/ipv4/ipip.c | 41 +-
net/ipv6/ip6_tunnel.c | 40 +-
net/ipv6/sit.c | 38 +-
net/mptcp/options.c | 21 +-
net/mptcp/protocol.c | 4 +-
net/mptcp/protocol.h | 14 +
net/mptcp/subflow.c | 12 +-
net/netfilter/ipset/ip_set_core.c | 19 +-
net/netfilter/ipset/ip_set_list_set.c | 7 +-
net/netfilter/ipvs/ip_vs_conn.c | 4 +-
net/netfilter/ipvs/ip_vs_core.c | 6 +-
net/netfilter/ipvs/ip_vs_ctl.c | 4 +-
net/netfilter/ipvs/ip_vs_dh.c | 4 +-
net/netfilter/ipvs/ip_vs_lblc.c | 2 +-
net/netfilter/ipvs/ip_vs_lblcr.c | 8 +-
net/netfilter/nf_conntrack_sip.c | 10 +-
net/netfilter/nf_flow_table_core.c | 7 +-
net/netfilter/nf_tables_offload.c | 2 +-
net/netfilter/nft_set_pipapo.c | 252 ++++++----
net/netfilter/nft_set_pipapo.h | 8 +
net/packet/af_packet.c | 7 +-
net/rxrpc/call_accept.c | 28 +-
net/rxrpc/call_object.c | 27 +-
net/rxrpc/recvmsg.c | 23 +-
net/sched/act_gact.c | 5 +
net/sched/act_police.c | 6 +
net/sched/sch_api.c | 24 +-
net/sched/sch_taprio.c | 12 +-
net/sctp/protocol.c | 20 +-
net/sctp/sysctl.c | 9 +-
net/smc/af_smc.c | 3 +-
net/smc/smc_rx.c | 12 +-
net/smc/smc_tx.c | 17 +-
net/tipc/socket.c | 6 +-
net/xfrm/espintcp.c | 32 +-
security/apparmor/include/net.h | 6 +-
security/apparmor/lsm.c | 38 +-
security/bpf/hooks.c | 3 +
security/security.c | 506 +++++++++++++--------
security/selinux/hooks.c | 91 ++--
security/selinux/include/objsec.h | 5 +
security/selinux/netlabel.c | 23 +-
security/selinux/ss/policydb.c | 31 ++
security/selinux/ss/services.c | 4 +-
security/smack/smack.h | 5 +
security/smack/smack_lsm.c | 66 ++-
security/smack/smack_netfilter.c | 8 +-
sound/core/seq/seq_timer.c | 13 +-
sound/hda/hdac_regmap.c | 4 +-
sound/soc/codecs/cs4265.c | 4 +-
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +-
sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +-
sound/usb/usx2y/usX2Yhwdep.c | 10 +-
sound/usb/usx2y/usbus428ctldefs.h | 2 +
sound/usb/usx2y/usbusx2y.c | 2 +-
sound/usb/usx2y/usx2yhwdeppcm.c | 15 +-
virt/kvm/kvm_main.c | 3 +
276 files changed, 4340 insertions(+), 2447 deletions(-)