-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 14 Jul 2024 09:22:50 +0200 Source: linux Architecture: source Version: 6.1.98-1 Distribution: bookworm-security Urgency: high Maintainer: Debian Kernel Team Changed-By: Salvatore Bonaccorso Closes: 983357 1067858 1071501 Changes: linux (6.1.98-1) bookworm-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.95 - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() - wifi: cfg80211: fully move wiphy work to unbound workqueue - wifi: cfg80211: Lock wiphy in cfg80211_get_station - wifi: cfg80211: pmsr: use correct nla_get_uX functions - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64 - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids - wifi: iwlwifi: mvm: don't read past the mfuart notifcation - wifi: mac80211: correctly parse Spatial Reuse Parameter Set element - ax25: Fix refcount imbalance on inbound connections - ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put() - [armhf] net/ncsi: Simplify Kconfig/dts control flow - [armhf] net/ncsi: Fix the multi thread manner of NCSI driver - ipv6: ioam: block BH from ioam6_output() - ipv6: sr: block BH in seg6_output_core() and seg6_input_core() - bpf: Set run context for rawtp test_run callback - net/smc: avoid overwriting when adjusting sock bufsizes - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) - vxlan: Fix regression when dropping packets due to invalid src addresses - tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB - net/mlx5: Stop waiting for PCI up if teardown was triggered - net/mlx5: Stop waiting for PCI if pci channel is offline - net/mlx5: Split function_setup() to enable and open functions - net/mlx5: Always stop health timer during driver removal - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail - ptp: Fix error message on failed pin verification - ice: fix iteration of TLVs in Preserved Fields Area - ice: Introduce new parameters in ice_sched_node - ice: remove null checks before devm_kfree() calls - ice: remove af_xdp_zc_qps bitmap - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail - af_unix: Set sk->sk_state under unix_state_lock() for truly disconencted peer. - af_unix: Annodate data-races around sk->sk_state for writers. - af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). - af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll(). - af_unix: Annotate data-race of sk->sk_state in unix_stream_connect(). - af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). - af_unix: Annotate data-race of sk->sk_state in unix_stream_read_skb(). - af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG. - af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen. - af_unix: Use unix_recvq_full_lockless() in unix_stream_connect(). - af_unix: annotate lockless accesses to sk->sk_err - af_unix: Use skb_queue_empty_lockless() in unix_release_sock(). - af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen(). - af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill(). - ipv6: fix possible race in __fib6_drop_pcpu_from() - Bluetooth: qca: fix invalid device address check - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() - usb: gadget: f_fs: use io_data->status consistently - usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete - iio: accel: mxc4005: allow module autoloading via OF compatible - iio: accel: mxc4005: Reset chip on probe() and resume() - xtensa: stacktrace: include for prototype - xtensa: fix MAKE_PC_FROM_RA second argument - drm/amd/display: drop unnecessary NULL checks in debugfs - drm/amd/display: Fix incorrect DSC instance for MST - [arm64] dts: qcom: sm8150: align TLMM pin configuration with DT schema - [arm64] dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration - misc/pvpanic: deduplicate common code - misc/pvpanic-pci: register attributes via pci_driver - serial: sc16is7xx: replace hardcoded divisor value with BIT() macro - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler - mmc: davinci: Don't strip remove function when driver is builtin - firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails - HID: i2c-hid: elan: Add ili9882t timing - HID: i2c-hid: elan: fix reset suspend current leakage - i2c: add fwnode APIs - i2c: acpi: Unbind mux adapters before delete - mm, vmalloc: fix high order __GFP_NOFAIL allocations - mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL - wifi: ath10k: fix QCOM_RPROC_COMMON dependency - btrfs: remove unnecessary prototype declarations at disk-io.c - btrfs: make btrfs_destroy_delayed_refs() return void - btrfs: fix leak of qgroup extent records after transaction abort - nilfs2: return the mapped address from nilfs_get_page() - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors - io_uring: check for non-NULL file pointer in io_file_can_poll() - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected - usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state - mei: me: release irq in mei_me_pci_resume error path - tty: n_tty: Fix buffer offsets when lookahead is used - landlock: Fix d_parent walk - jfs: xattr: fix buffer overflow for invalid xattr - xhci: Set correct transferred length for cancelled bulk transfers - xhci: Apply reset resume quirk to Etron EJ188 xHCI host - xhci: Handle TD clearing for multiple streams case - xhci: Apply broken streams quirk to Etron EJ188 xHCI host - [x86] thunderbolt: debugfs: Fix margin debugfs node creation condition - scsi: mpi3mr: Fix ATA NCQ priority support - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory - scsi: sd: Use READ(16) when reading block zero on large capacity disks (Closes: #1067858) - gve: Clear napi->skb before dev_kfree_skb_any() - [powerpc*] uaccess: Fix build errors seen with GCC 13/14 - Input: try trimming too long modalias strings (Closes: #983357) - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c - cachefiles: add output string to cachefiles_obj_[get|put]_ondemand_fd - cachefiles: remove requests from xarray during flushing requests - cachefiles: introduce object ondemand state - cachefiles: extract ondemand info field from cachefiles_object - cachefiles: resend an open request if the read request's object is closed - cachefiles: add spin_lock for cachefiles_ondemand_info - cachefiles: add restore command to recover inflight ondemand read requests - cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() - cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() - cachefiles: remove err_put_fd label in cachefiles_ondemand_daemon_read() - cachefiles: never get a new anonymous fd if ondemand_id is valid - cachefiles: defer exposing anon_fd until after copy_to_user() succeeds - cachefiles: flush all requests after setting CACHEFILES_DEAD - selftests/ftrace: Fix to check required event file - clk: sifive: Do not register clkdevs for PRCI clocks - NFSv4.1 enforce rootpath check in fs_location query - SUNRPC: return proper error from gss_wrap_req_priv - NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Closes: #1071501) - [x86] platform/x86: dell-smbios: Fix wrong token data in sysfs - gpio: tqmx86: fix typo in Kconfig label - gpio: tqmx86: remove unneeded call to platform_set_drvdata() - gpio: tqmx86: introduce shadow register for GPIO output value - gpio: tqmx86: Convert to immutable irq_chip - gpio: tqmx86: store IRQ trigger type and unmask status separately - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type - HID: core: remove unnecessary WARN_ON() in implement() - iommu/amd: Fix sysfs leak in iommu init - HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() - drm/vmwgfx: Port the framebuffer code to drm fb helpers - drm/vmwgfx: Refactor drm connector probing for display modes - drm/vmwgfx: Filter modes which exceed graphics memory - drm/vmwgfx: 3D disabled should not effect STDU memory limits - drm/vmwgfx: Remove STDU logic from generic mode_valid function - net: sfp: Always call `sfp_sm_mod_remove()` on remove - net: hns3: fix kernel crash problem in concurrent scenario - net: hns3: add cond_resched() to hns3 ring buffer init process - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet - drm/komeda: check for error-valued pointer - drm/bridge/panel: Fix runtime warning on panel bridge release - tcp: fix race in tcp_v6_syn_recv_sock() - geneve: Fix incorrect inner network header offset when innerprotoinherit is set - net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type - net: pse-pd: Use EOPNOTSUPP error code instead of ENOTSUPP - gve: ignore nonrelevant GSO type bits when processing TSO headers - net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters - nvmet-passthru: propagate status from id override functions - net/ipv6: Fix the RT cache flush via sysctl using a previous delay - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state - ionic: fix use after netif_napi_del() - af_unix: Read with MSG_PEEK loops if the first unread byte is OOB - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() - misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() (CVE-2024-36973) - [x86] boot: Don't add the EFI stub to targets, again - iio: adc: ad9467: fix scan type sign - iio: dac: ad5592r: fix temperature channel scaling value - iio: imu: inv_icm42600: delete unneeded update watermark call - drivers: core: synchronize really_probe() and dev_uevent() - drm/exynos/vidi: fix memory leak in .get_modes() - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found - mptcp: ensure snd_una is properly initialized on connect - mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID - irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update() - [x86] amd_nb: Check for invalid SMN reads - perf/core: Fix missing wakeup when waiting for context reference - riscv: fix overlap of allocated page and PTR_ERR - tracing/selftests: Fix kprobe event name test for .isra. functions - null_blk: Print correct max open zones limit in null_init_zoned_dev() - sock_map: avoid race between sock_map_close and sk_psock_put - vmci: prevent speculation leaks by sanitizing event in event_deliver() - spmi: hisi-spmi-controller: Do not override device identifier - knfsd: LOOKUP can return an illegal error value - fs/proc: fix softlockup in __read_vmcore - ocfs2: use coarse time for new created files - ocfs2: fix races between hole punching and AIO+DIO - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id - dmaengine: axi-dmac: fix possible race in remove() - remoteproc: k3-r5: Wait for core0 power-up before powering up core1 - remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs - [x86] drm/i915/gt: Disarm breadcrumbs if engines are already idle - [x86] drm/i915/dpt: Make DPT object unshrinkable - [x86] intel_th: pci: Add Granite Rapids support - [x86] intel_th: pci: Add Granite Rapids SOC support - [x86] intel_th: pci: Add Sapphire Rapids SOC support - [x86] intel_th: pci: Add Meteor Lake-S support - [x86] intel_th: pci: Add Lunar Lake support - btrfs: zoned: introduce a zone_info struct in btrfs_load_block_group_zone_info - btrfs: zoned: factor out per-zone logic from btrfs_load_block_group_zone_info - btrfs: zoned: factor out single bg handling from btrfs_load_block_group_zone_info - btrfs: zoned: factor out DUP bg handling from btrfs_load_block_group_zone_info - btrfs: zoned: fix use-after-free due to race with dev replace - nilfs2: fix potential kernel bug due to lack of writeback flag waiting - tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device() - mm/huge_memory: don't unpoison huge_zero_folio - mm/memory-failure: fix handling of dissolved but not taken off from buddy pages - serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level - mptcp: pm: update add_addr counters after connect - Revert "fork: defer linking file vma until vma is fully initialized" - remoteproc: k3-r5: Jump to error handling labels in start/stop errors - cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode - Bluetooth: qca: fix wcn3991 device address check - Bluetooth: qca: generalise device address check - greybus: Fix use-after-free bug in gb_interface_release due to race condition. - serial: 8250_dw: fall back to poll if there's no interrupt - serial: core: Add UPIO_UNKNOWN constant for unknown port type - usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) - misc: microchip: pci1xxxx: Fix a memory leak in the error handling of gp_aux_bus_probe() - i2c: at91: Fix the functionality flags of the slave-only interface - i2c: designware: Fix the functionality flags of the slave-only interface - zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.96 - padata: Disable BH when taking works lock on MT path - io_uring/sqpoll: work around a potential audit memory leak - block/ioctl: prefer different overflow check - batman-adv: bypass empty buckets in batadv_purge_orig_ref() - wifi: ath9k: work around memset overflow warning - af_packet: avoid a false positive warning in packet_setsockopt() - drop_monitor: replace spin_lock by raw_spin_lock - scsi: qedi: Fix crash while reading debugfs attribute - net/sched: fix false lockdep warning on qdisc root lock - net: dsa: realtek: keep default LED state in rtl8366rb - netpoll: Fix race condition in netpoll_owner_active - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery - HID: Add quirk for Logitech Casa touchpad - HID: asus: fix more n-key report descriptors if n-key quirked - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl - drm/amd/display: Exit idle optimizations before HDCP execution - [x86] platform/x86: toshiba_acpi: Add quirk for buttons on Z830 - [x86] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 - [arm64,armhf] drm/lima: add mask irq callback to gp and pp - [arm64,armhf] drm/lima: mask irqs in timeout path before hard reset - ALSA: hda/realtek: Add quirks for Lenovo 13X - [powerpc*] pseries: Enforce hcall result buffer validity and size - [powerpc*] io: Avoid clang null pointer arithmetic warnings - [x86] platform/x86: p2sb: Don't init until unassigned resources have been assigned - power: supply: cros_usbpd: provide ID table for avoiding fallback match - [arm64] iommu/arm-smmu-v3: Free MSIs in case of ENOMEM - f2fs: remove clear SB_INLINECRYPT flag in default_options - usb: misc: uss720: check for incompatible versions of the Belkin F5U002 - [arm64] usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380 - udf: udftime: prevent overflow in udf_disk_stamp_to_time() - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports - [arm64,armhf] serial: imx: Introduce timeout when waiting on transmitter empty - serial: exar: adding missing CTI and Exar PCI ids - usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API - tty: add the option to have a tty reject a new ldisc - tracing: Build event generation tests only as modules - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option - ice: move RDMA init to ice_idc.c - ice: avoid IRQ collision to fix init failure on ACPI S3 resume - cipso: fix total option length computation - bpf: Avoid splat in pskb_pull_reason - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM - netrom: Fix a memory leak in nr_heartbeat_expiry() - ipv6: prevent possible NULL deref in fib6_nh_init() - ipv6: prevent possible NULL dereference in rt6_probe() - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() - netns: Make get_net_ns() handle zero refcount net - qca_spi: Make interrupt remembering atomic - net: lan743x: disable WOL upon resume to restore full data path operation - net: lan743x: Support WOL at both the PHY and MAC appropriately - net: phy: mxl-gpy: enhance delay time required by loopback disable function - net: phy: mxl-gpy: Remove interrupt mask clearing from config_init - net/sched: act_api: rely on rcu in tcf_idr_check_alloc - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() - tipc: force a dst refcount before doing decryption - sched: act_ct: add netns into the key of tcf_ct_flow_table - ptp: fix integer overflow in max_vclocks_store - net: stmmac: No need to calculate speed divider when offload is disabled - virtio_net: checksum offloading handling fix - octeontx2-pf: Add error handling to VLAN unoffload handling - netfilter: ipset: Fix suspicious rcu_dereference_protected() - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors - ice: Fix VSI list rule with ICE_SW_LKUP_LAST type - bnxt_en: Restore PTP tx_avail count in case of skb_pad() error - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings - regulator: core: Fix modpost error "regulator_get_regmap" undefined - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list - dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting() - dmaengine: ioatdma: Fix leaking on version mismatch - dmaengine: ioat: use PCI core macros for PCIe Capability - dmaengine: ioatdma: Fix error path in ioat3_dma_probe() - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe() - dmaengine: ioatdma: Fix missing kmem_cache_destroy() - regulator: bd71815: fix ramp values - [arm64] dts: imx93-11x11-evk: Remove the 'no-sdio' property - [arm64] dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." - firmware: psci: Fix return value from psci_system_suspend() - RDMA/mlx5: Add check for srq max_sge attribute - net: stmmac: Assign configured channel value to EXTTS event - net: usb: ax88179_178a: improve reset check - net: do not leave a dangling sk pointer, when socket creation fails - btrfs: retry block group reclaim without infinite loop - cifs: fix typo in module parameter enable_gcm_256 - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() - [arm64] KVM: arm64: Disassociate vcpus from redistributor region on teardown - [x86] KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11. - ALSA: hda/realtek: Limit mic boost on N14AP7 - drm/i915/mso: using joiner is not possible with eDP MSO - drm/radeon: fix UBSAN warning in kv_dpm.c - drm/amdgpu: fix UBSAN warning in kv_dpm.c - gcov: add support for GCC 14 - kcov: don't lose track of remote references during softirqs - mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default - tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack() - mm/page_table_check: fix crash on ZONE_DEVICE - i2c: ocores: set IACK bit after core is enabled - dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema - [armhf] spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup() - [arm64] dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc - [armhf] spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4 - perf: script: add raw|disasm arguments to --insn-trace option - perf script: Show also errors for --insn-trace option - [armhf] dts: samsung: smdkv310: fix keypad no-autorepeat - [armhf] dts: samsung: exynos4412-origen: fix keypad no-autorepeat - [armhf] dts: samsung: smdk4412: fix keypad no-autorepeat - pmdomain: ti-sci: Fix duplicate PD referrals - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test - [x86] cpu/vfm: Add new macros to work with (vendor/family/model) values - [x86] cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL - Revert "kheaders: substituting --sort in archive creation" - kheaders: explicitly define file modes for archived headers - drm/amd/display: revert Exit idle optimizations before HDCP execution - net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path - hid: asus: asus_report_fixup: fix potential read out of bounds - Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default" https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.97 - usb: typec: ucsi: Never send a lone connector change ack - usb: typec: ucsi: Ack also failed Get Error commands - [x86] ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable - [x86] ACPI: x86: Force StorageD3Enable on more products - Input: ili210x - fix ili251x_read_touch_data() return value - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins - [arm64,armhf] pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins - [arm64,armhf] pinctrl: rockchip: use dedicated pinctrl type for RK3328 - [arm64,armhf] pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set - [mips*] pci: lantiq: restore reset gpio polarity - dt-bindings: i2c: Drop unneeded quotes - dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema - netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) - [arm64] ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk - [s390x] pci: Add missing virt_to_phys() for directed DIBV - ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe() - [arm64] ASoC: fsl-asoc-card: set priv->pdev before using it - net: dsa: microchip: fix initial port flush problem - bpf: Fix overrunning reservations in ringbuf - ibmvnic: Free any outstanding tx skbs during scrq reset - net: phy: micrel: add Microchip KSZ 9477 to the device table - net: dsa: microchip: use collision based back pressure mode - xdp: Remove WARN() from __xdp_reg_mem_model() - Fix race for duplicate reqsk on identical SYN - net: dsa: microchip: fix wrong register write when masking interrupt - [powerpc*] restore some missing spu syscalls - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() - [x86] fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup - mtd: partitions: redboot: Added conversion of operands to a larger type - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok() - bpf: Add a check for struct bpf_fib_lookup size - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode - RDMA/restrack: Fix potential invalid address access - net/iucv: Avoid explicit cpumask var allocation on stack - net/dpaa2: Avoid explicit cpumask var allocation on stack - crypto: ecdh - explicitly zeroize private_key - ALSA: emux: improve patch ioctl data validation - media: dvbdev: Initialize sbuf - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message - drm/radeon/radeon_display: Decrease the size of allocated memory - nvme: fixup comment for nvme RDMA Provider Type - drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA - [arm64] gpio: davinci: Validate the obtained number of IRQs - drm/amd/amdgpu: Fix style errors in amdgpu_drv.c & amdgpu_device.c - drm/amdgpu: Fix pci state save during mode-1 reset - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) - randomize_kstack: Remove non-functional per-arch entropy filtering - ima: Fix use-after-free on a dentry's dname.name - [x86] stop playing stack games in profile_pc() - Revert "MIPS: pci: lantiq: restore reset gpio polarity" - [arm64] pinctrl: qcom: spmi-gpio: drop broken pm8008 support - ocfs2: fix DIO failure due to insufficient transaction credits - nfs: drop the incorrect assertion in nfs_swap_rw() - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos - mmc: sdhci: Do not invert write-protect twice - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask - counter: ti-eqep: enable clock at probe - i2c: testunit: don't erase registers after STOP - i2c: testunit: discard write requests while old command is running - iio: adc: ad7266: Fix variable checking bug - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF - net: usb: ax88179_178a: improve link status logs - usb: gadget: printer: SS+ support - usb: gadget: printer: fix races against disable (CVE-2024-25741) - usb: musb: da8xx: fix a resource leak in probe() - usb: atm: cxacru: fix endpoint checking in cxacru_bind() - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock - usb: gadget: aspeed_udc: fix device address configuration - usb: ucsi: stm32: fix command completion handling - serial: 8250_omap: Implementation of Errata i2310 - serial: imx: set receiver level before starting uart - ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665 G11. - tty: mcf: MCF54418 has 10 UARTS - net: can: j1939: Initialize unused data in j1939_send_one() - net: can: j1939: recover socket queue on CAN bus error during BAM transmission - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new - cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing - cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked() - irqchip/loongson-liointc: Set different ISRs for different cores - kbuild: Install dtb files as 0644 in Makefile.dtbinst - btrfs: zoned: fix initial free space detection - csky, hexagon: fix broken sys_sync_file_range - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes - drm/amdgpu: avoid using null object of framebuffer - [x86] drm/i915/gt: Fix potential UAF by revoke of fence registers - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes - drm/amdgpu/atomfirmware: fix parsing of vram_info - batman-adv: Don't accept TT entries for out-of-spec VIDs - can: mcp251xfd: fix infinite loop when xmit fails - ata: ahci: Clean up sysfs file on error - ata: libata-core: Fix double free on error - ftruncate: pass a signed offset - syscalls: fix compat_sys_io_pgetevents_time64 usage - syscalls: fix sys_fanotify_mark prototype - Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units" - mm/page_alloc: Separate THP PCP into movable and non-movable categories - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc (CVE-2023-52760) - efi: memmap: Move manipulation routines into x86 arch tree - efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures - [x86] efi/x86: Free EFI memory map only when installing a new one. - [arm64] dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s - [arm64] dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s - [arm64] dts: rockchip: fix PMIC interrupt pin on ROCK Pi E - [arm64] dts: rockchip: Add sound-dai-cells for RK3368 - serial: imx: only set receiver level if it is zero - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check - tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.98 - locking/mutex: Introduce devm_mutex_init() - crypto: hisilicon/debugfs - Fix debugfs uninit process issue - [arm64,armhf] drm/lima: fix shared irq handling on driver remove - [powerpc*] Avoid nmi_enter/nmi_exit in real mode interrupt. - media: dvb: as102-fe: Fix as10x_register_addr packing - media: dvb-usb: dib0700_devices: Add missing release_firmware() - IB/core: Implement a limit on UMAD receive List - scsi: qedf: Make qedf_execute_tmf() non-preemptible - crypto: aead,cipher - zeroize key buffer after use - drm/amdgpu: Fix uninitialized variable warnings - drm/amdgpu: Initialize timestamp for some legacy SOCs - drm/amd/display: Check index msg_id before read or write - drm/amd/display: Check pipe offset before setting vblank - drm/amd/display: Skip finding free audio for unknown engine_id - drm/amdgpu: fix uninitialized scalar variable warning - media: dw2102: Don't translate i2c read into write - sctp: prefer struct_size over open coded arithmetic - firmware: dmi: Stop decoding on broken entry - Input: ff-core - prefer struct_size over open coded arithmetic - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB - wifi: mt76: replace skb_put with skb_put_zero - [arm64,armhf] net: dsa: mv88e6xxx: Correct check for empty list - media: dvb-frontends: tda18271c2dd: Remove casting during div - media: s2255: Use refcount_t instead of atomic_t for num_channels - media: dvb-frontends: tda10048: Fix integer overflow - i2c: i801: Annotate apanel_addr as __ro_after_init - [powerpc*] 64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n - orangefs: fix out-of-bounds fsid access - kunit: Fix timeout message - [powerpc*] xmon: Check cpu id in commands "c#", "dp#" and "dx#" - igc: fix a log entry using uninitialized netdev - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD - f2fs: check validation of fault attrs in f2fs_build_fault_attr() - scsi: mpi3mr: Sanitise num_phys - serial: imx: Raise TX trigger level to 8 - jffs2: Fix potential illegal address access in jffs2_free_inode - [s390x] pkey: Wipe sensitive data on failure - btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning - cdrom: rearrange last_media_change check to avoid unintentional overflow - mac802154: fix time calculation in ieee802154_configure_durations() - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() - net/mlx5: E-switch, Create ingress ACL when needed - net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup() - tcp_metrics: validate source addr length - [s390x] KVM: s390: fix LPSWEY handling - e1000e: Fix S0ix residency on corporate systems - net: allow skb_datagram_iter to be called from any context - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() - wifi: wilc1000: fix ies_len type in connect path - netfilter: nf_tables: unconditionally flush pending work before notifier - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487) - inet_diag: Initialize pad field in struct inet_diag_req_v2 - [x86] platform/x86: toshiba_acpi: Fix quickstart quirk handling - Revert "igc: fix a log entry using uninitialized netdev" - nilfs2: fix inode number range checks - nilfs2: add missing check for inode numbers on directory entries - mm: optimize the redundant loop of mm_update_owner_next() - mm: avoid overflows in dirty throttling logic - btrfs: fix adding block group to a reclaim list and the unused list during reclaim - f2fs: Add inline to f2fs_build_fault_attr() stub - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() - Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct - fsnotify: Do not generate events for O_PATH file descriptors - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes - drm/amdgpu/atomfirmware: silence UBSAN warning - drm: panel-orientation-quirks: Add quirk for Valve Galileo - [powerpc*] pseries: Fix scv instruction crash with kexec - mtd: rawnand: Ensure ECC configuration is propagated to upper layers - mtd: rawnand: Bypass a couple of sanity checks during NAND identification - mtd: rawnand: rockchip: ensure NVDDR timings are rejected - bnx2x: Fix multiple UBSAN array-index-out-of-bounds - [arm64] dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B - ima: Avoid blocking in RCU read-side critical section - media: dw2102: fix a potential buffer overflow - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents - clk: mediatek: clk-mtk: Register MFG notifier in mtk_clk_simple_probe() - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 - nvme-multipath: find NUMA path only for online numa-node - dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset - regmap-i2c: Subtract reg size from max_write - [x86] platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet - [x86] platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro - nvmet: fix a possible leak when destroy a ctrl during qp establishment - kbuild: fix short log for AS in link-vmlinux.sh - nfc/nci: Add the inconsistency check between the input data length and count - spi: cadence: Ensure data lines set to low during dummy-cycle period - null_blk: Do not allow runt zone with zone capacity smaller then zone size - nilfs2: fix incorrect inode allocation from reserved inodes . [ Salvatore Bonaccorso ] * [rt] Drop "drm/i915/gt: Queue and wait for the irq_work item." * Bump ABI to 23 * Drop now unknown config options for DRM_VMWGFX_FBCON * Refresh "firmware: Remove redundant log messages from drivers" * d/rules.real: Revert workaround to explicitly remove executable bits from dtb files (implemented upstream) * [rt] Update to 6.1.96-rt35 Checksums-Sha1: e315d18b4b6fef22810af6132ebaeb7fc6215f72 290924 linux_6.1.98-1.dsc 19b264466baf24d6555199481855af86fa69ca58 137642932 linux_6.1.98.orig.tar.xz e6084e17f809dc3152d4bad815644d4e7ad2e765 1650304 linux_6.1.98-1.debian.tar.xz b96872ee7024c8f92fe9fb408d8b19c4502604b5 6816 linux_6.1.98-1_source.buildinfo Checksums-Sha256: 82b6be67d838efe46645eb25ce453aebb056c96e5270f94fdebd3a870699ce5c 290924 linux_6.1.98-1.dsc 7c5fd35ee0182f7e5f9ef4dfbbe5c6cbd9bbdde0619f35c64fff07896f3c04e9 137642932 linux_6.1.98.orig.tar.xz 798ce409468c353e5687c708a62b78c552319bf85c504fdba930cb1802c6ac10 1650304 linux_6.1.98-1.debian.tar.xz 430be9a5ba7261d88cf3615aa63ca8c3763ed5257dea1d105b3adc6d93eebe26 6816 linux_6.1.98-1_source.buildinfo Files: a117fb6c4f60dc865bcc6ca368ecb661 290924 kernel optional linux_6.1.98-1.dsc 37d51656427c9e4c2f088631b45a4f77 137642932 kernel optional linux_6.1.98.orig.tar.xz 67e8bcf1fba19623dfe970b4549dfd03 1650304 kernel optional linux_6.1.98-1.debian.tar.xz 543ab6474aee185bab1200193592d555 6816 kernel optional linux_6.1.98-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmaTfWFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EqNAP/0DHQjtLHjU3t7gJ3bUDzyAC+V11IDgz +BqMrUz0K+2UBiL8XfyDPwgpXCXNxFM+xNqAeOmk0a5vD6DiEPt6qZ+5z36gbgrL 9GIKojjSDFEZQLrER3VQ+5HW560Li5dPgnv9VgbDjL2bzCs/hM7oO35fbHb4hdmY 0i/3XwEw3lRxG4WhhXjS1A4G6ku83ECwYxln6z4CPK0keJEUPS5hyjIRH5RV6zCr iRIl2K0O+0f1Pco6z2VmyBDUlezhyukF50ycY2QVnuOxGdWE+52BoZOnq5GlRioR D3c06QQ+GIsKchbL4CHDFBJBF3seRR9pxDxQXtGCRnWR9iajGvz+kFZteAWnf7Q2 q+5LuT9FU5yhI0dR+Tl2RICAGeOYCmMRmNCRTA+7v5S9ehSBer/XOj6frkEdILkX t66F2PIbgmVitufhxgM/35Vjb81maALfCP3EzupjgBQYD1DYl4qMqRRTMvK00xrp ZeCUNb8fAZJB2qQk5W48VW9dVb94iNKC65z4B2aMs1TZcgEX8VQhWv01x6GOPpsI uSJl4udsCbOn4iyiaKkqoezrKKL4ZoHRkoC679j4DWK5mz5stxzhNatj6xWSF7Uh 0S3g+ZoChXc4t0jaiJpAFCX37QNmGWmC68I9Z1/e2QSXUhYzFVaOtt5Tkm/juq/0 EPqEAHZgMGrg =+aUH -----END PGP SIGNATURE-----