-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 14 Jul 2024 09:22:50 +0200
Source: linux-signed-i386
Architecture: source
Version: 6.1.98+1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
linux-signed-i386 (6.1.98+1) bookworm-security; urgency=high
.
* Sign kernel from linux 6.1.98-1
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.95
- wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
- wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
- wifi: cfg80211: fully move wiphy work to unbound workqueue
- wifi: cfg80211: Lock wiphy in cfg80211_get_station
- wifi: cfg80211: pmsr: use correct nla_get_uX functions
- wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
- wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
- wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
- wifi: iwlwifi: mvm: don't read past the mfuart notifcation
- wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
- ax25: Fix refcount imbalance on inbound connections
- ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()
- [armhf] net/ncsi: Simplify Kconfig/dts control flow
- [armhf] net/ncsi: Fix the multi thread manner of NCSI driver
- ipv6: ioam: block BH from ioam6_output()
- ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
- bpf: Set run context for rawtp test_run callback
- net/smc: avoid overwriting when adjusting sock bufsizes
- net: sched: sch_multiq: fix possible OOB write in multiq_tune()
(CVE-2024-36978)
- vxlan: Fix regression when dropping packets due to invalid src addresses
- tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
- net/mlx5: Stop waiting for PCI up if teardown was triggered
- net/mlx5: Stop waiting for PCI if pci channel is offline
- net/mlx5: Split function_setup() to enable and open functions
- net/mlx5: Always stop health timer during driver removal
- net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
- ptp: Fix error message on failed pin verification
- ice: fix iteration of TLVs in Preserved Fields Area
- ice: Introduce new parameters in ice_sched_node
- ice: remove null checks before devm_kfree() calls
- ice: remove af_xdp_zc_qps bitmap
- net: wwan: iosm: Fix tainted pointer delete is case of region creation
fail
- af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted
peer.
- af_unix: Annodate data-races around sk->sk_state for writers.
- af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
- af_unix: Annotate data-races around sk->sk_state in unix_write_space() and
poll().
- af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().
- af_unix: Annotate data-races around sk->sk_state in sendmsg() and
recvmsg().
- af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb().
- af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
- af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
- af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
- af_unix: annotate lockless accesses to sk->sk_err
- af_unix: Use skb_queue_empty_lockless() in unix_release_sock().
- af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
- af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
- ipv6: fix possible race in __fib6_drop_pcpu_from()
- Bluetooth: qca: fix invalid device address check
- btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range()
- usb: gadget: f_fs: use io_data->status consistently
- usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
- iio: accel: mxc4005: allow module autoloading via OF compatible
- iio: accel: mxc4005: Reset chip on probe() and resume()
- xtensa: stacktrace: include <asm/ftrace.h> for prototype
- xtensa: fix MAKE_PC_FROM_RA second argument
- drm/amd/display: drop unnecessary NULL checks in debugfs
- drm/amd/display: Fix incorrect DSC instance for MST
- [arm64] dts: qcom: sm8150: align TLMM pin configuration with DT schema
- [arm64] dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration
- misc/pvpanic: deduplicate common code
- misc/pvpanic-pci: register attributes via pci_driver
- serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
- mmc: davinci: Don't strip remove function when driver is builtin
- firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails
- HID: i2c-hid: elan: Add ili9882t timing
- HID: i2c-hid: elan: fix reset suspend current leakage
- i2c: add fwnode APIs
- i2c: acpi: Unbind mux adapters before delete
- mm, vmalloc: fix high order __GFP_NOFAIL allocations
- mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL
- wifi: ath10k: fix QCOM_RPROC_COMMON dependency
- btrfs: remove unnecessary prototype declarations at disk-io.c
- btrfs: make btrfs_destroy_delayed_refs() return void
- btrfs: fix leak of qgroup extent records after transaction abort
- nilfs2: return the mapped address from nilfs_get_page()
- nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
- io_uring: check for non-NULL file pointer in io_file_can_poll()
- USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
- USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
- usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
- usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
- mei: me: release irq in mei_me_pci_resume error path
- tty: n_tty: Fix buffer offsets when lookahead is used
- landlock: Fix d_parent walk
- jfs: xattr: fix buffer overflow for invalid xattr
- xhci: Set correct transferred length for cancelled bulk transfers
- xhci: Apply reset resume quirk to Etron EJ188 xHCI host
- xhci: Handle TD clearing for multiple streams case
- xhci: Apply broken streams quirk to Etron EJ188 xHCI host
- [x86] thunderbolt: debugfs: Fix margin debugfs node creation condition
- scsi: mpi3mr: Fix ATA NCQ priority support
- scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
- scsi: sd: Use READ(16) when reading block zero on large capacity disks
(Closes: #1067858)
- gve: Clear napi->skb before dev_kfree_skb_any()
- [powerpc*] uaccess: Fix build errors seen with GCC 13/14
- Input: try trimming too long modalias strings (Closes: #983357)
- cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
- cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd
- cachefiles: remove requests from xarray during flushing requests
- cachefiles: introduce object ondemand state
- cachefiles: extract ondemand info field from cachefiles_object
- cachefiles: resend an open request if the read request's object is closed
- cachefiles: add spin_lock for cachefiles_ondemand_info
- cachefiles: add restore command to recover inflight ondemand read requests
- cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()
- cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()
- cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read()
- cachefiles: never get a new anonymous fd if ondemand_id is valid
- cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
- cachefiles: flush all requests after setting CACHEFILES_DEAD
- selftests/ftrace: Fix to check required event file
- clk: sifive: Do not register clkdevs for PRCI clocks
- NFSv4.1 enforce rootpath check in fs_location query
- SUNRPC: return proper error from gss_wrap_req_priv
- NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Closes: #1071501)
- [x86] platform/x86: dell-smbios: Fix wrong token data in sysfs
- gpio: tqmx86: fix typo in Kconfig label
- gpio: tqmx86: remove unneeded call to platform_set_drvdata()
- gpio: tqmx86: introduce shadow register for GPIO output value
- gpio: tqmx86: Convert to immutable irq_chip
- gpio: tqmx86: store IRQ trigger type and unmask status separately
- gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
- HID: core: remove unnecessary WARN_ON() in implement()
- iommu/amd: Fix sysfs leak in iommu init
- HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
- drm/vmwgfx: Port the framebuffer code to drm fb helpers
- drm/vmwgfx: Refactor drm connector probing for display modes
- drm/vmwgfx: Filter modes which exceed graphics memory
- drm/vmwgfx: 3D disabled should not effect STDU memory limits
- drm/vmwgfx: Remove STDU logic from generic mode_valid function
- net: sfp: Always call `sfp_sm_mod_remove()` on remove
- net: hns3: fix kernel crash problem in concurrent scenario
- net: hns3: add cond_resched() to hns3 ring buffer init process
- liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
- drm/komeda: check for error-valued pointer
- drm/bridge/panel: Fix runtime warning on panel bridge release
- tcp: fix race in tcp_v6_syn_recv_sock()
- geneve: Fix incorrect inner network header offset when innerprotoinherit
is set
- net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN)
packets
- Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
- netfilter: ipset: Fix race between namespace cleanup and gc in the
list:set type
- net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP
- gve: ignore nonrelevant GSO type bits when processing TSO headers
- net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs
parameters
- nvmet-passthru: propagate status from id override functions
- net/ipv6: Fix the RT cache flush via sysctl using a previous delay
- net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
- net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
- ionic: fix use after netif_napi_del()
- af_unix: Read with MSG_PEEK loops if the first unread byte is OOB
- bnxt_en: Adjust logging of firmware messages in case of released token in
__hwrm_send()
- misc: microchip: pci1xxxx: fix double free in the error handling of
gp_aux_bus_probe() (CVE-2024-36973)
- [x86] boot: Don't add the EFI stub to targets, again
- iio: adc: ad9467: fix scan type sign
- iio: dac: ad5592r: fix temperature channel scaling value
- iio: imu: inv_icm42600: delete unneeded update watermark call
- drivers: core: synchronize really_probe() and dev_uevent()
- drm/exynos/vidi: fix memory leak in .get_modes()
- drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID
found
- mptcp: ensure snd_una is properly initialized on connect
- mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
- irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
- [x86] amd_nb: Check for invalid SMN reads
- perf/core: Fix missing wakeup when waiting for context reference
- riscv: fix overlap of allocated page and PTR_ERR
- tracing/selftests: Fix kprobe event name test for .isra. functions
- null_blk: Print correct max open zones limit in null_init_zoned_dev()
- sock_map: avoid race between sock_map_close and sk_psock_put
- vmci: prevent speculation leaks by sanitizing event in event_deliver()
- spmi: hisi-spmi-controller: Do not override device identifier
- knfsd: LOOKUP can return an illegal error value
- fs/proc: fix softlockup in __read_vmcore
- ocfs2: use coarse time for new created files
- ocfs2: fix races between hole punching and AIO+DIO
- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
- dmaengine: axi-dmac: fix possible race in remove()
- remoteproc: k3-r5: Wait for core0 power-up before powering up core1
- remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
- [x86] drm/i915/gt: Disarm breadcrumbs if engines are already idle
- [x86] drm/i915/dpt: Make DPT object unshrinkable
- [x86] intel_th: pci: Add Granite Rapids support
- [x86] intel_th: pci: Add Granite Rapids SOC support
- [x86] intel_th: pci: Add Sapphire Rapids SOC support
- [x86] intel_th: pci: Add Meteor Lake-S support
- [x86] intel_th: pci: Add Lunar Lake support
- btrfs: zoned: introduce a zone_info struct in
btrfs_load_block_group_zone_info
- btrfs: zoned: factor out per-zone logic from
btrfs_load_block_group_zone_info
- btrfs: zoned: factor out single bg handling from
btrfs_load_block_group_zone_info
- btrfs: zoned: factor out DUP bg handling from
btrfs_load_block_group_zone_info
- btrfs: zoned: fix use-after-free due to race with dev replace
- nilfs2: fix potential kernel bug due to lack of writeback flag waiting
- tick/nohz_full: Don't abuse smp_call_function_single() in
tick_setup_device()
- mm/huge_memory: don't unpoison huge_zero_folio
- mm/memory-failure: fix handling of dissolved but not taken off from buddy
pages
- serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
- mptcp: pm: update add_addr counters after connect
- Revert "fork: defer linking file vma until vma is fully initialized"
- remoteproc: k3-r5: Jump to error handling labels in start/stop errors
- cachefiles, erofs: Fix NULL deref in when cachefiles is not doing
ondemand-mode
- Bluetooth: qca: fix wcn3991 device address check
- Bluetooth: qca: generalise device address check
- greybus: Fix use-after-free bug in gb_interface_release due to race
condition.
- serial: 8250_dw: fall back to poll if there's no interrupt
- serial: core: Add UPIO_UNKNOWN constant for unknown port type
- usb-storage: alauda: Check whether the media is initialized
(CVE-2024-38619)
- misc: microchip: pci1xxxx: Fix a memory leak in the error handling of
gp_aux_bus_probe()
- i2c: at91: Fix the functionality flags of the slave-only interface
- i2c: designware: Fix the functionality flags of the slave-only interface
- zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.96
- padata: Disable BH when taking works lock on MT path
- io_uring/sqpoll: work around a potential audit memory leak
- block/ioctl: prefer different overflow check
- batman-adv: bypass empty buckets in batadv_purge_orig_ref()
- wifi: ath9k: work around memset overflow warning
- af_packet: avoid a false positive warning in packet_setsockopt()
- drop_monitor: replace spin_lock by raw_spin_lock
- scsi: qedi: Fix crash while reading debugfs attribute
- net/sched: fix false lockdep warning on qdisc root lock
- net: dsa: realtek: keep default LED state in rtl8366rb
- netpoll: Fix race condition in netpoll_owner_active
- wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
- HID: Add quirk for Logitech Casa touchpad
- HID: asus: fix more n-key report descriptors if n-key quirked
- Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
- drm/amd/display: Exit idle optimizations before HDCP execution
- [x86] platform/x86: toshiba_acpi: Add quirk for buttons on Z830
- [x86] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
- [arm64,armhf] drm/lima: add mask irq callback to gp and pp
- [arm64,armhf] drm/lima: mask irqs in timeout path before hard reset
- ALSA: hda/realtek: Add quirks for Lenovo 13X
- [powerpc*] pseries: Enforce hcall result buffer validity and size
- [powerpc*] io: Avoid clang null pointer arithmetic warnings
- [x86] platform/x86: p2sb: Don't init until unassigned resources have been
assigned
- power: supply: cros_usbpd: provide ID table for avoiding fallback match
- [arm64] iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
- f2fs: remove clear SB_INLINECRYPT flag in default_options
- usb: misc: uss720: check for incompatible versions of the Belkin F5U002
- [arm64] usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on
Lenovo Yoga Tab2 1380
- udf: udftime: prevent overflow in udf_disk_stamp_to_time()
- PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
- [arm64,armhf] serial: imx: Introduce timeout when waiting on transmitter
empty
- serial: exar: adding missing CTI and Exar PCI ids
- usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
- tty: add the option to have a tty reject a new ldisc
- tracing: Build event generation tests only as modules
- ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
- ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
- ice: move RDMA init to ice_idc.c
- ice: avoid IRQ collision to fix init failure on ACPI S3 resume
- cipso: fix total option length computation
- bpf: Avoid splat in pskb_pull_reason
- ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
- netrom: Fix a memory leak in nr_heartbeat_expiry()
- ipv6: prevent possible NULL deref in fib6_nh_init()
- ipv6: prevent possible NULL dereference in rt6_probe()
- xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
- netns: Make get_net_ns() handle zero refcount net
- qca_spi: Make interrupt remembering atomic
- net: lan743x: disable WOL upon resume to restore full data path operation
- net: lan743x: Support WOL at both the PHY and MAC appropriately
- net: phy: mxl-gpy: enhance delay time required by loopback disable
function
- net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
- net/sched: act_api: rely on rcu in tcf_idr_check_alloc
- net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
- tipc: force a dst refcount before doing decryption
- sched: act_ct: add netns into the key of tcf_ct_flow_table
- ptp: fix integer overflow in max_vclocks_store
- net: stmmac: No need to calculate speed divider when offload is disabled
- virtio_net: checksum offloading handling fix
- octeontx2-pf: Add error handling to VLAN unoffload handling
- netfilter: ipset: Fix suspicious rcu_dereference_protected()
- seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6
behaviors
- ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
- bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
- net: usb: rtl8150 fix unintiatilzed variables in
rtl8150_get_link_ksettings
- regulator: core: Fix modpost error "regulator_get_regmap" undefined
- dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
- dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
- dmaengine: ioatdma: Fix leaking on version mismatch
- dmaengine: ioat: use PCI core macros for PCIe Capability
- dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
- dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
- dmaengine: ioatdma: Fix missing kmem_cache_destroy()
- regulator: bd71815: fix ramp values
- [arm64] dts: imx93-11x11-evk: Remove the 'no-sdio' property
- [arm64] dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
- ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is
fine."
- firmware: psci: Fix return value from psci_system_suspend()
- RDMA/mlx5: Add check for srq max_sge attribute
- net: stmmac: Assign configured channel value to EXTTS event
- net: usb: ax88179_178a: improve reset check
- net: do not leave a dangling sk pointer, when socket creation fails
- btrfs: retry block group reclaim without infinite loop
- cifs: fix typo in module parameter enable_gcm_256
- KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
- [arm64] KVM: arm64: Disassociate vcpus from redistributor region on
teardown
- [x86] KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
- ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465
G11.
- ALSA: hda/realtek: Limit mic boost on N14AP7
- drm/i915/mso: using joiner is not possible with eDP MSO
- drm/radeon: fix UBSAN warning in kv_dpm.c
- drm/amdgpu: fix UBSAN warning in kv_dpm.c
- gcov: add support for GCC 14
- kcov: don't lose track of remote references during softirqs
- mm: mmap: allow for the maximum number of bits for randomizing mmap_base
by default
- tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
- mm/page_table_check: fix crash on ZONE_DEVICE
- i2c: ocores: set IACK bit after core is enabled
- dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to
i2c-controller schema
- [armhf] spi: stm32: qspi: Fix dual flash mode sanity test in
stm32_qspi_setup()
- [arm64] dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
- [armhf] spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to
CCR_BUSWIDTH_4
- perf: script: add raw|disasm arguments to --insn-trace option
- perf script: Show also errors for --insn-trace option
- [armhf] dts: samsung: smdkv310: fix keypad no-autorepeat
- [armhf] dts: samsung: exynos4412-origen: fix keypad no-autorepeat
- [armhf] dts: samsung: smdk4412: fix keypad no-autorepeat
- pmdomain: ti-sci: Fix duplicate PD referrals
- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
- [x86] cpu/vfm: Add new macros to work with (vendor/family/model) values
- [x86] cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
- Revert "kheaders: substituting --sort in archive creation"
- kheaders: explicitly define file modes for archived headers
- drm/amd/display: revert Exit idle optimizations before HDCP execution
- net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
- hid: asus: asus_report_fixup: fix potential read out of bounds
- Revert "mm: mmap: allow for the maximum number of bits for randomizing
mmap_base by default"
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.97
- usb: typec: ucsi: Never send a lone connector change ack
- usb: typec: ucsi: Ack also failed Get Error commands
- [x86] ACPI: x86: utils: Add Picasso to the list for forcing
StorageD3Enable
- [x86] ACPI: x86: Force StorageD3Enable on more products
- Input: ili210x - fix ili251x_read_touch_data() return value
- pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
- [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
- [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
- [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328
- [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
- [mips*] pci: lantiq: restore reset gpio polarity
- dt-bindings: i2c: Drop unneeded quotes
- dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
- netfilter: nf_tables: use timestamp to check for set element timeout
(CVE-2024-27397)
- [arm64] ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right
mclk
- [s390x] pci: Add missing virt_to_phys() for directed DIBV
- ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
- [arm64] ASoC: fsl-asoc-card: set priv->pdev before using it
- net: dsa: microchip: fix initial port flush problem
- bpf: Fix overrunning reservations in ringbuf
- ibmvnic: Free any outstanding tx skbs during scrq reset
- net: phy: micrel: add Microchip KSZ 9477 to the device table
- net: dsa: microchip: use collision based back pressure mode
- xdp: Remove WARN() from __xdp_reg_mem_model()
- Fix race for duplicate reqsk on identical SYN
- net: dsa: microchip: fix wrong register write when masking interrupt
- [powerpc*] restore some missing spu syscalls
- tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
- netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data
registers
- bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
- [x86] fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
- mtd: partitions: redboot: Added conversion of operands to a larger type
- wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
- bpf: Add a check for struct bpf_fib_lookup size
- bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
- RDMA/restrack: Fix potential invalid address access
- net/iucv: Avoid explicit cpumask var allocation on stack
- net/dpaa2: Avoid explicit cpumask var allocation on stack
- crypto: ecdh - explicitly zeroize private_key
- ALSA: emux: improve patch ioctl data validation
- media: dvbdev: Initialize sbuf
- soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
- drm/radeon/radeon_display: Decrease the size of allocated memory
- nvme: fixup comment for nvme RDMA Provider Type
- drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
- [arm64] gpio: davinci: Validate the obtained number of IRQs
- drm/amd/amdgpu: Fix style errors in amdgpu_drv.c & amdgpu_device.c
- drm/amdgpu: Fix pci state save during mode-1 reset
- gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
- randomize_kstack: Remove non-functional per-arch entropy filtering
- ima: Fix use-after-free on a dentry's dname.name
- [x86] stop playing stack games in profile_pc()
- Revert "MIPS: pci: lantiq: restore reset gpio polarity"
- [arm64] pinctrl: qcom: spmi-gpio: drop broken pm8008 support
- ocfs2: fix DIO failure due to insufficient transaction credits
- nfs: drop the incorrect assertion in nfs_swap_rw()
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
- mmc: sdhci: Do not invert write-protect twice
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
- counter: ti-eqep: enable clock at probe
- i2c: testunit: don't erase registers after STOP
- i2c: testunit: discard write requests while old command is running
- iio: adc: ad7266: Fix variable checking bug
- iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
- net: usb: ax88179_178a: improve link status logs
- usb: gadget: printer: SS+ support
- usb: gadget: printer: fix races against disable (CVE-2024-25741)
- usb: musb: da8xx: fix a resource leak in probe()
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
- usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to
avoid deadlock
- usb: gadget: aspeed_udc: fix device address configuration
- usb: ucsi: stm32: fix command completion handling
- serial: 8250_omap: Implementation of Errata i2310
- serial: imx: set receiver level before starting uart
- ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665
G11.
- tty: mcf: MCF54418 has 10 UARTS
- net: can: j1939: Initialize unused data in j1939_send_one()
- net: can: j1939: recover socket queue on CAN bus error during BAM
transmission
- net: can: j1939: enhanced error handling for tightly received RTS messages
in xtp_rx_rts_session_new
- cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
- cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
- irqchip/loongson-liointc: Set different ISRs for different cores
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
- btrfs: zoned: fix initial free space detection
- csky, hexagon: fix broken sys_sync_file_range
- drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
- drm/amdgpu: avoid using null object of framebuffer
- [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers
- drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
- drm/amdgpu/atomfirmware: fix parsing of vram_info
- batman-adv: Don't accept TT entries for out-of-spec VIDs
- can: mcp251xfd: fix infinite loop when xmit fails
- ata: ahci: Clean up sysfs file on error
- ata: libata-core: Fix double free on error
- ftruncate: pass a signed offset
- syscalls: fix compat_sys_io_pgetevents_time64 usage
- syscalls: fix sys_fanotify_mark prototype
- Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
- mm/page_alloc: Separate THP PCP into movable and non-movable categories
- gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (CVE-2023-52760)
- efi: memmap: Move manipulation routines into x86 arch tree
- efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
- [x86] efi/x86: Free EFI memory map only when installing a new one.
- [arm64] dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
- [arm64] dts: rockchip: Rename LED related pinctrl nodes on
rk3308-rock-pi-s
- [arm64] dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
- [arm64] dts: rockchip: Add sound-dai-cells for RK3368
- serial: imx: only set receiver level if it is zero
- serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
- tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.98
- locking/mutex: Introduce devm_mutex_init()
- crypto: hisilicon/debugfs - Fix debugfs uninit process issue
- [arm64,armhf] drm/lima: fix shared irq handling on driver remove
- [powerpc*] Avoid nmi_enter/nmi_exit in real mode interrupt.
- media: dvb: as102-fe: Fix as10x_register_addr packing
- media: dvb-usb: dib0700_devices: Add missing release_firmware()
- IB/core: Implement a limit on UMAD receive List
- scsi: qedf: Make qedf_execute_tmf() non-preemptible
- crypto: aead,cipher - zeroize key buffer after use
- drm/amdgpu: Fix uninitialized variable warnings
- drm/amdgpu: Initialize timestamp for some legacy SOCs
- drm/amd/display: Check index msg_id before read or write
- drm/amd/display: Check pipe offset before setting vblank
- drm/amd/display: Skip finding free audio for unknown engine_id
- drm/amdgpu: fix uninitialized scalar variable warning
- media: dw2102: Don't translate i2c read into write
- sctp: prefer struct_size over open coded arithmetic
- firmware: dmi: Stop decoding on broken entry
- Input: ff-core - prefer struct_size over open coded arithmetic
- usb: xhci: prevent potential failure in handle_tx_event() for Transfer
events without TRB
- wifi: mt76: replace skb_put with skb_put_zero
- [arm64,armhf] net: dsa: mv88e6xxx: Correct check for empty list
- media: dvb-frontends: tda18271c2dd: Remove casting during div
- media: s2255: Use refcount_t instead of atomic_t for num_channels
- media: dvb-frontends: tda10048: Fix integer overflow
- i2c: i801: Annotate apanel_addr as __ro_after_init
- [powerpc*] 64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
- orangefs: fix out-of-bounds fsid access
- kunit: Fix timeout message
- [powerpc*] xmon: Check cpu id in commands "c#", "dp#" and "dx#"
- igc: fix a log entry using uninitialized netdev
- bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
- f2fs: check validation of fault attrs in f2fs_build_fault_attr()
- scsi: mpi3mr: Sanitise num_phys
- serial: imx: Raise TX trigger level to 8
- jffs2: Fix potential illegal address access in jffs2_free_inode
- [s390x] pkey: Wipe sensitive data on failure
- btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation
warning
- cdrom: rearrange last_media_change check to avoid unintentional overflow
- mac802154: fix time calculation in ieee802154_configure_durations()
- UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
- net/mlx5: E-switch, Create ingress ACL when needed
- net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
- tcp_metrics: validate source addr length
- [s390x] KVM: s390: fix LPSWEY handling
- e1000e: Fix S0ix residency on corporate systems
- net: allow skb_datagram_iter to be called from any context
- net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from
__netif_rx()
- wifi: wilc1000: fix ies_len type in connect path
- netfilter: nf_tables: unconditionally flush pending work before notifier
- bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
(CVE-2024-39487)
- inet_diag: Initialize pad field in struct inet_diag_req_v2
- [x86] platform/x86: toshiba_acpi: Fix quickstart quirk handling
- Revert "igc: fix a log entry using uninitialized netdev"
- nilfs2: fix inode number range checks
- nilfs2: add missing check for inode numbers on directory entries
- mm: optimize the redundant loop of mm_update_owner_next()
- mm: avoid overflows in dirty throttling logic
- btrfs: fix adding block group to a reclaim list and the unused list during
reclaim
- f2fs: Add inline to f2fs_build_fault_attr() stub
- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
- Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
- can: kvaser_usb: Explicitly initialize family in leafimx driver_info
struct
- fsnotify: Do not generate events for O_PATH file descriptors
- Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
again"
- drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
- drm/amdgpu/atomfirmware: silence UBSAN warning
- drm: panel-orientation-quirks: Add quirk for Valve Galileo
- [powerpc*] pseries: Fix scv instruction crash with kexec
- mtd: rawnand: Ensure ECC configuration is propagated to upper layers
- mtd: rawnand: Bypass a couple of sanity checks during NAND identification
- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
- bnx2x: Fix multiple UBSAN array-index-out-of-bounds
- [arm64] dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model
B
- ima: Avoid blocking in RCU read-side critical section
- media: dw2102: fix a potential buffer overflow
- clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
- clk: mediatek: clk-mtk: Register MFG notifier in mtk_clk_simple_probe()
- clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
- i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
- ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
- nvme-multipath: find NUMA path only for online numa-node
- dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
- nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
- regmap-i2c: Subtract reg size from max_write
- [x86] platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW
11.6" tablet
- [x86] platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
- nvmet: fix a possible leak when destroy a ctrl during qp establishment
- kbuild: fix short log for AS in link-vmlinux.sh
- nfc/nci: Add the inconsistency check between the input data length and
count
- spi: cadence: Ensure data lines set to low during dummy-cycle period
- null_blk: Do not allow runt zone with zone capacity smaller then zone size
- nilfs2: fix incorrect inode allocation from reserved inodes
.
[ Salvatore Bonaccorso ]
* [rt] Drop "drm/i915/gt: Queue and wait for the irq_work item."
* Bump ABI to 23
* Drop now unknown config options for DRM_VMWGFX_FBCON
* Refresh "firmware: Remove redundant log messages from drivers"
* d/rules.real: Revert workaround to explicitly remove executable bits from
dtb files (implemented upstream)
* [rt] Update to 6.1.96-rt35
Checksums-Sha1:
66695f4efc3dee54558e5bd90307abb28cc3733a 14034 linux-signed-i386_6.1.98+1.dsc
011330d92049672d6bc77152c23d1159527069ff 4069376 linux-signed-i386_6.1.98+1.tar.xz
Checksums-Sha256:
403349c2e3cb13ff35a4d0900998a670a80ea7309825fe2fded825c1deb35d5d 14034 linux-signed-i386_6.1.98+1.dsc
c9cbae3a509a1623c10e6a0937b92a934a51edd6616effa5ab03289a739b2bd9 4069376 linux-signed-i386_6.1.98+1.tar.xz
Files:
7525b674200b45ce92137a1a4ebf1b81 14034 kernel optional linux-signed-i386_6.1.98+1.dsc
388308c51eb09f707ab4ddb0c8a382e6 4069376 kernel optional linux-signed-i386_6.1.98+1.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfKFfvHEI+gkU+E+di0FRiLdONzYFAmaUlIEACgkQi0FRiLdO
NzZtNA/9EEjK58ffEID83WXrbolwfrVZK+G+0VKXtYS0PYH0E5Z8DaLXQH64z96a
dzwfbhoE8xDv2v7sNyTZuHLq1q20yU2foxi62LCVSGndKR+2seTjB0oBWC58j9vt
S7lzV0mceIb/jhh0vPNG/ZsbZTM+CwpnQ8Jcv1eZBbXSyOlE9zhF7FBWC8jvtoUJ
Zdsd7K0jELlmO0rvlmEH/aE53U1CSbQ5WSs6eJy/Z3QpzD9iZV/UQgWYyN0x92tO
9V3SwRhRKKAr4YpP3NEuyagER/pv3pm7P88Yo+MveXcynchPQf1am4ZtM7ysLG7o
lX1bfBhaaIeJTAreQABDXizGN/K2lukPitHV/Arl85/bGcz/CljSbBL/y25V0BN3
qtiNjTS1S9IU/baWc2yduEdIl2QkatDust6v4vCNTC6JWj5hK+MxmrGt/3csA1+O
QTCvirXpcQa9XKsqs2af/F87eGYdKOrFD1lKaD+Nu3evBTSzbsN2r4hTJDj6vKSV
M/hQf3es4o3svDoOqrzYG5ehITB26NKFFVip/WSOx8O0UjBZjB04yU3CzOyQpcx2
ZWAeZ+xpjZfHi51pNYAawo23/CLVc+G2+7Prdw11F1xnabwYrlmZuJjwPndRJfDU
HX7Rk5Dzr348tzW8chg88Xnb6EB6QmE+FDJ42BY6DCt2NB0V7Rg=
=+HwZ
-----END PGP SIGNATURE-----
