UPDATE: 6.12.108

[fepitre-bot]

Update to 6.12.108

Details

Changes since previous version:
gregkh/linux@74456843f18b PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
gregkh/linux@825b95561d7b Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
gregkh/linux@013448eb7b0d ALSA: scarlett2: Use a private URB for the notification endpoint
gregkh/linux@c5398ce6db76 rndis_host: add overflow check in rndis_rx_fixup()
gregkh/linux@84be002b40d3 gpio: ml-ioh: use raw_spinlock_t for the register lock
gregkh/linux@447ddf805994 gve: fix zero-length skb frag with header-split
gregkh/linux@cfb38b036992 hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
gregkh/linux@d4ae8dba90b8 netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
gregkh/linux@69d27cf39966 inet: frags: add inet_frag_putn() helper
gregkh/linux@872c093deef0 ipv4: frags: remove ipq_put()
gregkh/linux@8a681bcea4c4 inet: frags: change inet_frag_kill() to defer refcount updates
gregkh/linux@da9c1c1a1c0f inet: frags: save a pair of atomic operations in reassembly
gregkh/linux@39c6c4b267b6 inet: frags: publish queues before arming timer
gregkh/linux@c321dc5172c8 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
gregkh/linux@3f2a15f33f86 NTB: ntb_netdev: Preserve RX queue depth on allocation failure
gregkh/linux@9f6989e477f0 serial: amba-pl011: synchronize DMA teardown
gregkh/linux@5ed1be08b353 serial: sc16is7xx: rename EFR mutex with generic name
gregkh/linux@76a91352fbd6 serial: sc16is7xx: use guards for simple mutex locks
gregkh/linux@49bd99360538 serial: sc16is7xx: enable THRI before filling TX FIFO
gregkh/linux@f607b13ad656 xfs: namespace the maximum length/refcount symbols
gregkh/linux@fbfd43c85b1a xfs: don't use a xfs_log_iovec for ri_buf in log recovery
gregkh/linux@7e32d4eebae6 xfs: bounds-check buffer log item's dirty bitmap
gregkh/linux@063dd7a53d4e xfs: hoist per-bucket unlinked list check to helper
gregkh/linux@599453f83458 xfs: don't livelock in scrub on a circular unlinked list
gregkh/linux@c9f10a001c24 ALSA: dummy: Check card index validity at probe
gregkh/linux@b9eb5c9fdd81 ocfs2: fix missing metadata reservation for large xattrs
gregkh/linux@5327827c7dba null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
gregkh/linux@18799e858b40 kcov: fix data corruption and race conditions on PREEMPT_RT
gregkh/linux@889ec86464d2 ext4: stop retrying saturated xattr cache entries
gregkh/linux@e0aeee3b3d3c ext4: clear error before retrying inode xattr space fallback
gregkh/linux@40b741de4a82 ext4: propagate errors from fast commit range replay
gregkh/linux@98a42bb9d60d xfs: validate attr entry pointer before field access
gregkh/linux@c59219a6b62d libceph: fix OOB read in decode_watchers() via missing bounds check
gregkh/linux@af4c0606f743 nfc: digital: clamp SENSF_RES length to the destination buffer
gregkh/linux@0d723090645b nfc: fdp: bound the device-reported read length and fix an skb leak
gregkh/linux@e6397fe7b8b5 nfc: microread: validate target discovery payload lengths
gregkh/linux@389986fd79e4 nfc: llcp: bound the connect_sn TLV walk to the skb
gregkh/linux@382eaa770335 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
gregkh/linux@eab47618e282 nfc: llcp: reject PDUs shorter than the LLCP header
gregkh/linux@e16927728137 nfc: pn533: purge fragmented skbs during cleanup
gregkh/linux@0f344944c506 nfc: st21nfca: validate ATR_REQ length against the received frame
gregkh/linux@50e87e1c0e18 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
gregkh/linux@7086dab72b3e nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
gregkh/linux@022969dee274 nfc: nci: free destination parameters when closing a connection
gregkh/linux@4bfce749ef19 ndisc: ndisc_send_redirect() cleanup
gregkh/linux@ee944a706a18 Input: byd - synchronize timer deletion before freeing private data
gregkh/linux@36e0741833bd ipv4: reject undersized MTUs in ip_do_fragment()
gregkh/linux@3c770ac4e6f0 ipv6: fix use-after-free in ip6_finish_output2()
gregkh/linux@dfcf013f7770 nvmet-auth: zero the AUTH_RECEIVE response buffer
gregkh/linux@371fb1bf902a nvmet-fc: fix invalid free in LS IOD error path
gregkh/linux@d2acc96c528d nvmet-tcp: bound SGL data length before allocating command buffers
gregkh/linux@c509f20be1ca nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
gregkh/linux@d4a241723234 mptcp: pm: fix data race in add_addr timer callback
gregkh/linux@2ed3601e9db0 ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
gregkh/linux@491c499295fb drm/xe: Fix DPT allocation paths.
gregkh/linux@d863aa31bd04 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
gregkh/linux@448260a3ec95 HID: magicmouse: re-enable multitouch after reset-resume
gregkh/linux@9bdf8c7bfd79 HID: magicmouse: do not keep a stale msc->input if no input is claimed
gregkh/linux@ba6af07e700b HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
gregkh/linux@a38212687519 HID: core: fix OOB read of field->usage in hid_set_field()
gregkh/linux@881a805a8029 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
gregkh/linux@8dd8929b71c4 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
gregkh/linux@684efb2c86c8 ipv4: start using dst_dev_rcu()
gregkh/linux@b2a0b55bf613 mptcp: pm: fix memory leak from alloc-during-teardown race
gregkh/linux@40e812ced723 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
gregkh/linux@b9a651311fd4 Input: atkbd - skip deactivate for HONOR ZQC-P
gregkh/linux@addca61f9a23 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
gregkh/linux@3288bec1a21d HID: nintendo: register input device after capabilities are set
gregkh/linux@03a84f9f88b4 HID: nintendo: stop device IO before hid_hw_stop on probe failure
gregkh/linux@dd8035dec26e HID: core: fix number/pointer type confusion on long items
gregkh/linux@244a1cb63837 HID: sensor: custom: Fix use-after-free in enable_sensor
gregkh/linux@f84d777574b7 HID: hyperv: validate initial device info bounds
gregkh/linux@d57702d4c556 Bluetooth: hci_event: fix LE list UAF on reset
gregkh/linux@a34df5c4a439 Bluetooth: hci_event: validate LE Set CIG Parameters response
gregkh/linux@8715ffd60872 Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
gregkh/linux@7733b01ed136 Bluetooth: hci_aml: validate firmware segment lengths
gregkh/linux@03cb8cc2961f net: gro: properly validate BIG TCP aggregation criteria
gregkh/linux@8b74a2fbba5a Linux 6.12.106
gregkh/linux@dec2edb7aaf1 inet: frags: strip GSO state from fragments before reassembly
gregkh/linux@f717995cb7dc Linux 6.12.107
gregkh/linux@0136b528b753 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
gregkh/linux@bc6e94379451 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
gregkh/linux@d8636c8f9f95 KVM: x86/mmu: Check write tracking in all address spaces
gregkh/linux@ed1cd834da65 ext4: don't enable DAX on new encrypted files
gregkh/linux@2acc77e88670 io_uring/io-wq: fix worker accounting when canceling creation callbacks
gregkh/linux@d19f98c79f1b nvme-tcp: fix usage of page_frag_cache
gregkh/linux@569eff012480 HID: uhid: convert to hid_safe_input_report()
gregkh/linux@dd0e4d0441a0 selinux: use known type instead of void pointer
gregkh/linux@778fdda45307 selinux: avoid unnecessary indirection in struct level_datum
gregkh/linux@8e14b420188c selinux: make more use of str_read() when loading the policy
gregkh/linux@47f287839263 selinux: use u16 for security classes
gregkh/linux@8c07940b6cc8 selinux: more strict policy parsing
gregkh/linux@6c2ab7c4549f selinux: reject a permission value exceeding the class permission count
gregkh/linux@42a2949e0155 selinux: require a class's permission values to cover its permission count
gregkh/linux@e593031ff19a perf: Reject exited events as group leaders
gregkh/linux@77038187890e jfs: add check read-only before truncation in jfs_truncate_nolock()
gregkh/linux@939dba7a6404 jfs: add check read-only before txBeginAnon() call
gregkh/linux@005fee039dd8 ibmvnic: Use kernel helpers for hex dumps
gregkh/linux@233340626cf1 jfs: Fix null-ptr-deref in jfs_ioc_trim
gregkh/linux@29abaf93357f exfat: fix double free in delayed_free
gregkh/linux@2fbe83fe23f5 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
gregkh/linux@544ffd62ddd0 mISDN: hfcpci: Fix warning when deleting uninitialized timer
gregkh/linux@4e154cb5e768 can: j1939: implement NETDEV_UNREGISTER notification handler
gregkh/linux@90265bd35d89 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
gregkh/linux@02871132d8b0 can: j1939: make j1939_sk_bind() fail if device is no longer registered
gregkh/linux@08aca586482e smc: Fix use-after-free in __pnet_find_base_ndev().
gregkh/linux@c0fcd72e7eb5 KVM: arm64: Prevent access to vCPU events before init
gregkh/linux@956c57daba55 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
gregkh/linux@326e5cf301d0 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
gregkh/linux@9210ae708dde ASoC: nau8821: Cancel delayed work on component remove
gregkh/linux@1a2dc103e164 bpf: Fix use-after-free in offloaded map/prog info fill
gregkh/linux@2a7d1daf2674 riscv: Fix register corruption from uninitialized cregs on error
gregkh/linux@bea242c21187 Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
gregkh/linux@a6cd64ead3b4 ASoC: nau8821: Cancel pending work before suspend
gregkh/linux@2c10b145972f smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
gregkh/linux@0e7899950308 selinux: switch two allocations to use kzalloc_objs()
gregkh/linux@2b3a3c5d72da ring buffer: Propagate __rb_map_vma return value to caller
gregkh/linux@ef05dae9abb6 veth: fix OOB txq access in veth_poll() with asymmetric queue counts
gregkh/linux@45afabe7f99c powerpc/hv-gpci: fix preempt count leak in sysfs show paths
gregkh/linux@b708aa5cb142 ksmbd: harden file lifetime during session teardown
gregkh/linux@44b379a89076 nilfs2: correct return value kernel-doc descriptions for ioctl functions
gregkh/linux@68aa9ab6f8f2 nilfs2: reject invalid block index in GC ioctl
gregkh/linux@9b01f5af0dc5 nfc: nci: add data_len bound checks to activation parameter extractors
gregkh/linux@f49fbb6c1353 HID: pidff: Rework pidff_set_time() to fix warnings
gregkh/linux@dc6a6f604dce HID: pidff: Use ARRAY_SIZE macro instead of sizeof
gregkh/linux@c6cd31a5e280 HID: pidff: clang-format pass
gregkh/linux@ad9330f7e74a HID: pidff: fix OOB write when hid->inputs is empty
gregkh/linux@ab7bd22eeca0 HID: asus: simplify RGB init sequence
gregkh/linux@bdb2e0a2a359 HID: asus: fix missing hid_is_usb() check
gregkh/linux@e951ee73e423 HID: ft260: validate i2c input report length
gregkh/linux@5aa5a1b7cc4b HID: ft260: fix stack-use-after-return write in I2C read race
gregkh/linux@e750cdb6de00 HID: uclogic: fix use-after-free of inrange_timer on remove
gregkh/linux@1cd4bea9cb46 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
gregkh/linux@87ad116ac3ab Bluetooth: hci_sync: Fix accept list UAF during suspend
gregkh/linux@bec338b07beb HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
gregkh/linux@198590bcd2ee fpga: dfl: fme: add error handling
gregkh/linux@a4bb1242c858 accessibility: speakup: unregister tty ldisc on later init failures
gregkh/linux@65b2f6f79753 usb: xhci: Handle USB3 port events when there is one roothub
gregkh/linux@943f976c93e7 xhci: dbgtty: Fix unregister on tty_register_driver() failure
gregkh/linux@3c281882d0c4 xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
gregkh/linux@ea9fea370b8d fuse: fix invalidate lock leak on setattr writeback failure
gregkh/linux@7288c279ddbd fuse: fix invalidate lock leak on open O_TRUNC DAX failure
gregkh/linux@48a4e549b8df usb: usbtest: disable dynamic ID support
gregkh/linux@2efbfd42441d usb: gadget: f_tcm: keep port count until LUN teardown completes
gregkh/linux@b7f10d4ff987 tls: device: fix out-of-bounds write in tls_append_frag()
gregkh/linux@5f77ddb27563 gtp: serialize PDP context updates
gregkh/linux@efb867f04917 x86/CPU/AMD: Carve out a Zen5 models range
gregkh/linux@e477275951de net/tcp: fix TCP-AO key deletion in VRFs
gregkh/linux@594ba77210a1 tcp: fix AO info use-after-free in tcp_ao_connect_init()
gregkh/linux@84a93b4e0125 net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
gregkh/linux@4b31a875693c xfrm: espintcp: fix UAF during close
gregkh/linux@c296d25efbc8 xfrm: drop ESP-in-TCP packets with no ingress device
gregkh/linux@ea0921046231 xfrm: avoid lock inversion in nat keepalive work
gregkh/linux@1516e31ac458 xfrm: ah6: validate routing header segments_left
gregkh/linux@71d42da01740 xfrm: fix xfrm_state_construct() auth-trunc leak
gregkh/linux@71cdc4bb7aa7 xfrm: bound nat keepalive state collection
gregkh/linux@3a0ad4fcdfa0 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
gregkh/linux@0e3f01fe2e70 ipv6: seg6: clear IPv4 control block on IPIP decapsulation
gregkh/linux@da1f5aa7ec93 batman-adv: reject unrepresentable multicast TVLV offsets
gregkh/linux@2a7c2f008432 vxlan: keep the last remote linked during FDB flush
gregkh/linux@df86c0e84025 netfilter: nf_tables: don't queue packet path object notifications
gregkh/linux@45fec72da424 mm/swap: reject swapon() on filesystem-level encrypted files
gregkh/linux@34455bbab8db crypto: qcom-rng - Enable clock in hwrng case
gregkh/linux@813e6718a199 crypto: qcom-rng - Allow zero as a random number
gregkh/linux@bb474dcd9d02 crypto: qcom-rng - Remove crypto_rng interface
gregkh/linux@1f7b304b5577 crypto: atmel-tdes - use scatterlist length before DMA mapping
gregkh/linux@002f1f99aef7 crypto: qce - fix CCM AAD buffer underallocation
gregkh/linux@da14fae5203b crypto: mxs-dcp - fix source scatterlist length access
gregkh/linux@ca1a361e9e82 crypto: qce - Remove unsafe/deprecated algorithms
gregkh/linux@7d23489f5110 KVM: s390: vsie: zero stale crypto bits
gregkh/linux@bf2288583b4e usb: core: Add lock to usb_wakeup_notification()
gregkh/linux@b810896d6018 usb: core: Strengthen error handling in hub_hub_status()
gregkh/linux@7639ec9755d3 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
gregkh/linux@5a625fc2284e ALSA: usb-audio: Complete cleanup after system-resume errors
gregkh/linux@060db7d48af1 USB: serial: option: fix slab OOB read in interrupt URB callback
gregkh/linux@75894aa664f3 USB: serial: spcp8x5: drop broken carrier detect support
gregkh/linux@ff172092cba7 USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
gregkh/linux@9a72b180f057 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
gregkh/linux@b3cde26a66b0 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
gregkh/linux@064531c7e30c Linux 6.12.108