UPDATE: 6.6.156

[fepitre-bot]

Update to 6.6.156

Details

Changes since previous version:
gregkh/linux@8d08713ec83a PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
gregkh/linux@362726c9c6e5 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
gregkh/linux@10a6b9907969 rndis_host: add overflow check in rndis_rx_fixup()
gregkh/linux@fcaf8ba7e56b NTB: ntb_netdev: Preserve RX queue depth on allocation failure
gregkh/linux@c8c8e895f65f serial: amba-pl011: synchronize DMA teardown
gregkh/linux@c4ab0d688802 perf: Unify perf_event_free_task() / perf_event_exit_task_context()
gregkh/linux@80c6054a4c40 perf/core: Fix group leader use-after-free after sibling detach
gregkh/linux@1606abb7ce8c serial: qcom-geni: fix TX DMA buffer flush
gregkh/linux@969e3867ef67 serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
gregkh/linux@7047aa394d6c serial: sc16is7xx: convert bitmask definitions to use BIT() macro
gregkh/linux@a289a78f13ab serial: sc16is7xx: rename EFR mutex with generic name
gregkh/linux@811b44be278b serial: sc16is7xx: use guards for simple mutex locks
gregkh/linux@4a8887dd3a8a serial: sc16is7xx: enable THRI before filling TX FIFO
gregkh/linux@4d40d900ffb2 inet: frags: add inet_frag_putn() helper
gregkh/linux@c69b3593aa73 ipv4: frags: remove ipq_put()
gregkh/linux@32fa602b5dd6 inet: frags: change inet_frag_kill() to defer refcount updates
gregkh/linux@bb7488c797d0 inet: frags: save a pair of atomic operations in reassembly
gregkh/linux@d3ffb89b2944 inet: frags: publish queues before arming timer
gregkh/linux@2eca18dd026b xfs: don't use a xfs_log_iovec for ri_buf in log recovery
gregkh/linux@b7528b42813f xfs: bounds-check buffer log item's dirty bitmap
gregkh/linux@b20eb7ecbdaa ALSA: dummy: Check card index validity at probe
gregkh/linux@6a009f1e61b1 ocfs2: fix missing metadata reservation for large xattrs
gregkh/linux@075e52fd6d86 null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
gregkh/linux@a2fb8222cde2 kcov: fix data corruption and race conditions on PREEMPT_RT
gregkh/linux@a40c45268f43 ext4: stop retrying saturated xattr cache entries
gregkh/linux@46116f574be3 ext4: clear error before retrying inode xattr space fallback
gregkh/linux@e99120b5944a xfs: validate attr entry pointer before field access
gregkh/linux@b6505a4cea45 gpio: ml-ioh: use raw_spinlock_t for the register lock
gregkh/linux@152fcb74a268 s390/vfio_ccw: Free all memory if cp_init() fails
gregkh/linux@460b977a4e71 s390/vfio_ccw: Ensure first IDAW remains constant
gregkh/linux@f0d189d95eee s390/vfio_ccw: Calculate idal length based on idaw type
gregkh/linux@a3d60ae24183 s390/vfio_ccw: Implement a crw lock
gregkh/linux@3227cd511675 drm/amd/amdgpu: disable ASPM in some situations
gregkh/linux@874d1bdda79b drm/amd/display: Fix BT2020 YCbCr limited/full range input
gregkh/linux@b287812f88a1 drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
gregkh/linux@77693fb8aec3 drm/amdgpu: check ASPM on the dGPU host link
gregkh/linux@d0756a98277e nfc: digital: clamp SENSF_RES length to the destination buffer
gregkh/linux@fc3c2bd5b1ec nfc: fdp: bound the device-reported read length and fix an skb leak
gregkh/linux@18f02354ed22 nfc: microread: validate target discovery payload lengths
gregkh/linux@1964addc8dd5 nfc: llcp: bound the connect_sn TLV walk to the skb
gregkh/linux@a209334ed929 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
gregkh/linux@3793d768b40f nfc: llcp: reject PDUs shorter than the LLCP header
gregkh/linux@4a52ec2457ff nfc: pn533: purge fragmented skbs during cleanup
gregkh/linux@9635507fe829 nfc: st21nfca: validate ATR_REQ length against the received frame
gregkh/linux@24761d3a5f69 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
gregkh/linux@7489f59d1ea2 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
gregkh/linux@790576dc7ccc nfc: nci: free destination parameters when closing a connection
gregkh/linux@3a398e09a6c1 ndisc: ndisc_send_redirect() cleanup
gregkh/linux@28d984a66b9e Input: byd - synchronize timer deletion before freeing private data
gregkh/linux@eab3eeb68bfc libceph: fix OOB read in decode_watchers() via missing bounds check
gregkh/linux@b0ea911453ce ipv4: reject undersized MTUs in ip_do_fragment()
gregkh/linux@087ee0d914aa ipv6: fix use-after-free in ip6_finish_output2()
gregkh/linux@8f6363c8d54d nvmet-auth: zero the AUTH_RECEIVE response buffer
gregkh/linux@d094582cce9c nvmet-fc: fix invalid free in LS IOD error path
gregkh/linux@86cc45002247 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
gregkh/linux@925cb11b60c1 ASoC: sof: pcm: use snd_pcm_direction_name()
gregkh/linux@93c9bee22615 ASoC: SOF: Relocate and rework functionality for PCM stream freeing
gregkh/linux@5f291adb281e ASoC: SOF: pcm: Move period/buffer configuration print after platform open
gregkh/linux@74ec9c120e90 ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
gregkh/linux@4931c09d8387 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
gregkh/linux@48b76879f5bf ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
gregkh/linux@13aa13ce3d65 mptcp: pm: fix data race in add_addr timer callback
gregkh/linux@514a814c7427 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
gregkh/linux@3d7a7bac4c75 HID: magicmouse: do not keep a stale msc->input if no input is claimed
gregkh/linux@9b3469d162e3 HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
gregkh/linux@c1d9c16af51c HID: core: fix OOB read of field->usage in hid_set_field()
gregkh/linux@f0ab9a71167b xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
gregkh/linux@c4cec575a6d6 Bluetooth: hci_sync: Fix advertising data UAFs
gregkh/linux@346f0edba1d4 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
gregkh/linux@a5321b00b98e Input: atkbd - skip deactivate for HONOR ZQC-P
gregkh/linux@bb32e9a6a9a9 mptcp: pm: fix memory leak from alloc-during-teardown race
gregkh/linux@bd397c4123a4 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
gregkh/linux@abec577de5fc HID: core: fix number/pointer type confusion on long items
gregkh/linux@2ce90cfc6646 HID: sensor: custom: Fix use-after-free in enable_sensor
gregkh/linux@334271d3812a HID: hyperv: validate initial device info bounds
gregkh/linux@0628cc9b2fa2 Bluetooth: hci_event: fix LE list UAF on reset
gregkh/linux@26741d178f31 Bluetooth: hci_event: validate LE Set CIG Parameters response
gregkh/linux@e907bf694ed5 net: gro: properly validate BIG TCP aggregation criteria
gregkh/linux@93e0c9521fa8 Linux 6.6.154
gregkh/linux@3edf721bb4b9 inet: frags: strip GSO state from fragments before reassembly
gregkh/linux@a4a971135a2f Linux 6.6.155
gregkh/linux@f5e6580a3a16 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
gregkh/linux@429b6f43b4d8 KVM: x86/mmu: Check write tracking in all address spaces
gregkh/linux@a13f61ba9b2a ext4: don't enable DAX on new encrypted files
gregkh/linux@eb1e94fee5e2 io_uring/io-wq: fix worker accounting when canceling creation callbacks
gregkh/linux@ff3f428df00b Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal"
gregkh/linux@c1164f14c636 bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
gregkh/linux@ce12e1170c0c perf: Reject exited events as group leaders
gregkh/linux@e217492f6fa2 bpf: Remove tst_run from lwt_seg6local_prog_ops.
gregkh/linux@41da1715cd24 jfs: add check read-only before truncation in jfs_truncate_nolock()
gregkh/linux@47a99881ecc5 jfs: add check read-only before txBeginAnon() call
gregkh/linux@9bc078818ec7 ibmvnic: Use kernel helpers for hex dumps
gregkh/linux@a39f811a9f5e jfs: Fix null-ptr-deref in jfs_ioc_trim
gregkh/linux@ac65f76db9b2 exfat: fix double free in delayed_free
gregkh/linux@71209954f1e8 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
gregkh/linux@75194165e650 mISDN: hfcpci: Fix warning when deleting uninitialized timer
gregkh/linux@76957b618ce7 can: j1939: implement NETDEV_UNREGISTER notification handler
gregkh/linux@fd8c807f8d5f can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
gregkh/linux@53ca5b78b69d can: j1939: make j1939_sk_bind() fail if device is no longer registered
gregkh/linux@302dbed4760b smc: Fix use-after-free in __pnet_find_base_ndev().
gregkh/linux@7b854e68365a KVM: arm64: Prevent access to vCPU events before init
gregkh/linux@80d1fd39f4e3 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
gregkh/linux@4f5f52a58429 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
gregkh/linux@36fb28fa033f ASoC: nau8821: Cancel delayed work on component remove
gregkh/linux@5662dac41a34 bpf: Fix use-after-free in offloaded map/prog info fill
gregkh/linux@66dedb6028c3 riscv: Fix register corruption from uninitialized cregs on error
gregkh/linux@b671ba32c563 Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
gregkh/linux@a698d43ce95b ASoC: nau8821: Cancel pending work before suspend
gregkh/linux@9a4d8e559c3c smc: Use _sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
gregkh/linux@4f15e7704c33 selinux: switch two allocations to use kzalloc_objs()
gregkh/linux@524323f52cbf net/sched: Fix mirred deadlock on device recursion
gregkh/linux@2df9641e4b62 net/sched: initialize noop_qdisc owner
gregkh/linux@b300312562fd powerpc/hv-gpci: fix preempt count leak in sysfs show paths
gregkh/linux@bfd861dadd3a crypto: starfive - Do not free stack buffer
gregkh/linux@4241e3b406c8 ksmbd: harden file lifetime during session teardown
gregkh/linux@e971a37c68cb ext4: make state in ext4_mb_mark_bb to be bool
gregkh/linux@0b34ea0dc2bb ext4: make some fast commit functions reuse extents path
gregkh/linux@267a15c4f994 ext4: propagate errors from fast commit range replay
gregkh/linux@df75b4d1656b nilfs2: correct return value kernel-doc descriptions for ioctl functions
gregkh/linux@a5e776e29375 nilfs2: reject invalid block index in GC ioctl
gregkh/linux@e25b44bd8b8c nfc: nci: add data_len bound checks to activation parameter extractors
gregkh/linux@250cea475827 HID: magicmouse: re-enable multitouch after reset-resume
gregkh/linux@d16df755b449 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
gregkh/linux@59d4c2352e82 nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
gregkh/linux@cb8b78b34593 nvme: fix status magic numbers
gregkh/linux@e4f43b3d8588 nvme: rename CDR/MORE/DNR to NVME_STATUS*
gregkh/linux@25ad03d5c0e8 nvmet-tcp: bound SGL data length before allocating command buffers
gregkh/linux@c023443f0e6c HID: nintendo: stop device IO before hid_hw_stop on probe failure
gregkh/linux@3a32b93cff2a HID: ft260: validate i2c input report length
gregkh/linux@460514d46e88 HID: ft260: fix stack-use-after-return write in I2C read race
gregkh/linux@9d77ac82e57e HID: uclogic: fix use-after-free of inrange_timer on remove
gregkh/linux@1acff0590a44 HID: pidff: Support device error response from PID_BLOCK_LOAD
gregkh/linux@e9f2ce45b311 HID: pidff: clang-format pass
gregkh/linux@2e0471bf3ab2 HID: pidff: fix OOB write when hid->inputs is empty
gregkh/linux@b95bc136fe54 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
gregkh/linux@b5181516a9f5 Bluetooth: hci_sync: Fix accept list UAF during suspend
gregkh/linux@95f90c6029ca xfs: remove file_path tracepoint data
gregkh/linux@ba537c32de31 fpga: dfl: fme: add error handling
gregkh/linux@daba8d1cd995 accessibility: speakup: unregister tty ldisc on later init failures
gregkh/linux@d27599347b69 usb: xhci: Handle USB3 port events when there is one roothub
gregkh/linux@eaca2814f32b xhci: dbgtty: Fix unregister on tty_register_driver() failure
gregkh/linux@c36e7e4eb83e xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
gregkh/linux@92588d187ba4 fuse: fix invalidate lock leak on setattr writeback failure
gregkh/linux@dcf30a56624c fuse: fix invalidate lock leak on open O_TRUNC DAX failure
gregkh/linux@f95e57b66195 usb: usbtest: disable dynamic ID support
gregkh/linux@ad6f0375d2e9 usb: gadget: f_tcm: keep port count until LUN teardown completes
gregkh/linux@a832d7cb09da tls: device: fix out-of-bounds write in tls_append_frag()
gregkh/linux@5953e7a89966 x86/CPU/AMD: Add X86_FEATURE_ZEN5
gregkh/linux@ed9cf952fdec x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
gregkh/linux@fa05e559102e x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
gregkh/linux@7287cc121131 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
gregkh/linux@a62216735102 x86/CPU/AMD: Carve out a Zen5 models range
gregkh/linux@ff8dd7a932f3 xfrm: espintcp: fix UAF during close
gregkh/linux@2dd1609cadff xfrm: drop ESP-in-TCP packets with no ingress device
gregkh/linux@f00df8500e5a xfrm: ah6: validate routing header segments_left
gregkh/linux@c8837bbe7922 xfrm: fix xfrm_state_construct() auth-trunc leak
gregkh/linux@7c54fd8cfbcf net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
gregkh/linux@f52f1e75716d ipv6: seg6: clear IPv4 control block on IPIP decapsulation
gregkh/linux@da45847766b5 mm/swap: reject swapon() on filesystem-level encrypted files
gregkh/linux@4d35a92dd3da crypto: atmel-tdes - use scatterlist length before DMA mapping
gregkh/linux@cc56d2b0d77c crypto: qce - fix CCM AAD buffer underallocation
gregkh/linux@1537bd55b4f8 crypto: mxs-dcp - fix source scatterlist length access
gregkh/linux@fb8110b748b2 crypto: qce - Remove unsafe/deprecated algorithms
gregkh/linux@087c19cc60a8 KVM: s390: vsie: zero stale crypto bits
gregkh/linux@04ab26040797 usb: core: Add lock to usb_wakeup_notification()
gregkh/linux@656bd0ccb900 usb: core: Strengthen error handling in hub_hub_status()
gregkh/linux@94e4562fcc81 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
gregkh/linux@f1c05c41d07b ALSA: usb-audio: Complete cleanup after system-resume errors
gregkh/linux@030e3a73d3c3 USB: serial: option: fix slab OOB read in interrupt URB callback
gregkh/linux@8e987c4daf4f USB: serial: spcp8x5: drop broken carrier detect support
gregkh/linux@62cd519ab74c USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
gregkh/linux@65879e0a452c usb: usbfs: fix use-after-free of usb_device in usbdev_release()
gregkh/linux@8b73de7da85f Linux 6.6.156