UPDATE: 6.1.187

[fepitre-bot]

Update to 6.1.187

Details

Changes since previous version:
gregkh/linux@baf9b0383ff7 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
gregkh/linux@56f0aa75c764 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
gregkh/linux@f8e6fde5db87 rndis_host: add overflow check in rndis_rx_fixup()
gregkh/linux@4d0892a90b57 ALSA: dummy: Check card index validity at probe
gregkh/linux@b4663405ae29 ocfs2: fix missing metadata reservation for large xattrs
gregkh/linux@41dd31117565 null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
gregkh/linux@5dc59fc959b2 kcov: fix data corruption and race conditions on PREEMPT_RT
gregkh/linux@8865cd664484 ext4: stop retrying saturated xattr cache entries
gregkh/linux@d1efdcb37287 ext4: clear error before retrying inode xattr space fallback
gregkh/linux@03a12253dd2a xfs: validate attr entry pointer before field access
gregkh/linux@13327ed95222 misc: fastrpc: Rework fastrpc_req_munmap
gregkh/linux@99f8de36c84c misc: fastrpc: Remove buffer from list prior to unmap operation
gregkh/linux@272df0fbe6f3 NTB: ntb_netdev: Preserve RX queue depth on allocation failure
gregkh/linux@f70c9d4fba46 serial: amba-pl011: synchronize DMA teardown
gregkh/linux@4fe9b3b9e4b8 perf/core: Fix child_total_time_enabled accounting bug at task exit
gregkh/linux@6449c4223b53 perf: Fix cgroup state vs ERROR
gregkh/linux@3b1e5c44653f perf: Fix dangling cgroup pointer in cpuctx
gregkh/linux@f8a07021679a perf/core: Fix group leader use-after-free after sibling detach
gregkh/linux@142e287b3a25 packet: use consistent hard_header_len in non-ring send paths
gregkh/linux@e79f59a8527a packet: use consistent hard_header_len in TX_RING send path
gregkh/linux@7a11226e02f5 serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
gregkh/linux@739499f1da1a serial: sc16is7xx: convert bitmask definitions to use BIT() macro
gregkh/linux@d11f15dbbf83 serial: sc16is7xx: rename EFR mutex with generic name
gregkh/linux@b0c3604f816c serial: sc16is7xx: use guards for simple mutex locks
gregkh/linux@d40a28ab302e serial: sc16is7xx: enable THRI before filling TX FIFO
gregkh/linux@88ecc4e120bc net/packet: convert po->pressure to an atomic flag
gregkh/linux@f015c9de92b7 packet: synchronize pressure clearing with ring reconfiguration
gregkh/linux@08a04d7bfb9c inet: frags: publish queues before arming timer
gregkh/linux@b94b28c1f0fa s390/vfio_ccw: Cancel existing workqueues
gregkh/linux@7e9954e72120 drm/amdgpu: disallow multiple FENCE chunks in one submit
gregkh/linux@c9b85aa2cf73 s390/vfio_ccw: Move cp cleanup out of not operational
gregkh/linux@56d7488533ce s390/vfio_ccw: Selectively expand io_mutex
gregkh/linux@0edd222730a9 s390/vfio_ccw: Implement a crw lock
gregkh/linux@cacb1245edf4 xfs: don't use a xfs_log_iovec for ri_buf in log recovery
gregkh/linux@f7b5fa83e2c1 xfs: bounds-check buffer log item's dirty bitmap
gregkh/linux@0514f3054738 drm/amdgpu: check ASPM on the dGPU host link
gregkh/linux@63d2230e5076 gpio: ml-ioh: use raw_spinlock_t for the register lock
gregkh/linux@6509e270ae1b tls: fix lockless read of strp->msg_ready in ->poll
gregkh/linux@ef50eaab631f tls: handle data disappearing from under the TLS ULP
gregkh/linux@b8c9f25fd843 iomap: adjust read range correctly for non-block-aligned positions
gregkh/linux@4e942da2869b nfc: digital: clamp SENSF_RES length to the destination buffer
gregkh/linux@8d2c243b7985 nfc: fdp: bound the device-reported read length and fix an skb leak
gregkh/linux@cb2986722824 nfc: microread: validate target discovery payload lengths
gregkh/linux@65a0ec7783b0 nfc: llcp: bound the connect_sn TLV walk to the skb
gregkh/linux@9c47d6679635 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
gregkh/linux@a7b9b449f5a5 nfc: llcp: reject PDUs shorter than the LLCP header
gregkh/linux@d63e85c5d555 nfc: pn533: purge fragmented skbs during cleanup
gregkh/linux@dd26d30f40c4 nfc: st21nfca: validate ATR_REQ length against the received frame
gregkh/linux@afd8605fb43b nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
gregkh/linux@fe69fed3495f nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
gregkh/linux@be678c7a41eb nfc: nci: free destination parameters when closing a connection
gregkh/linux@2ff70a8edba1 ndisc: ndisc_send_redirect() cleanup
gregkh/linux@f161be39201e libceph: fix OOB read in decode_watchers() via missing bounds check
gregkh/linux@74ce7389f8f5 ipv4: reject undersized MTUs in ip_do_fragment()
gregkh/linux@d960881b9312 ipv6: fix use-after-free in ip6_finish_output2()
gregkh/linux@447b668faa14 nvmet-auth: zero the AUTH_RECEIVE response buffer
gregkh/linux@1a8f007faefe nvmet-fc: fix invalid free in LS IOD error path
gregkh/linux@e7077e6c4542 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
gregkh/linux@84b205297fa1 Input: byd - synchronize timer deletion before freeing private data
gregkh/linux@f84f2c81d792 ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
gregkh/linux@81d814214816 mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
gregkh/linux@5da972efed3d mptcp: pm: ADD_ADDR rtx: free sk if last
gregkh/linux@e19f1e37f93d mptcp: pm: fix data race in add_addr timer callback
gregkh/linux@403cc9bd6ccb HID: magicmouse: do not keep a stale msc->input if no input is claimed
gregkh/linux@da86a2bf716f HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
gregkh/linux@313ead1abed9 HID: core: fix OOB read of field->usage in hid_set_field()
gregkh/linux@f833821e4b52 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
gregkh/linux@17e01e342af7 s390/vfio_ccw: Free all memory if cp_init() fails
gregkh/linux@d7d4a8a75cd3 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
gregkh/linux@eb6b7753e8f7 Input: atkbd - skip deactivate for HONOR ZQC-P
gregkh/linux@cadee54a8691 can: use skb hash instead of private variable in headroom
gregkh/linux@2753722612d8 can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
gregkh/linux@4753cc37b660 misc: fastrpc: Fix double free of 'buf' in error path
gregkh/linux@33ea29f8b614 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
gregkh/linux@634f498ea5d5 HID: core: fix number/pointer type confusion on long items
gregkh/linux@d37ff4e3635c HID: sensor: custom: Fix use-after-free in enable_sensor
gregkh/linux@8614c043b11c HID: hyperv: validate initial device info bounds
gregkh/linux@8e68c380290b Bluetooth: hci_event: fix LE list UAF on reset
gregkh/linux@37a5dcd6837f net: gro: properly validate BIG TCP aggregation criteria
gregkh/linux@79a9660d699e Linux 6.1.185
gregkh/linux@14a8f3e10fa9 inet: frags: strip GSO state from fragments before reassembly
gregkh/linux@d64a499eea6b Linux 6.1.186
gregkh/linux@9b7d66ea88ae RDMA/rxe: Fix OOB in free_rd_atomic_resources()
gregkh/linux@47276297140e inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
gregkh/linux@09aa68552d25 KVM: x86/mmu: Check write tracking in all address spaces
gregkh/linux@5959cad3cfa8 ext4: don't enable DAX on new encrypted files
gregkh/linux@3d8500dfcc85 io_uring/io-wq: fix worker accounting when canceling creation callbacks
gregkh/linux@a10f5080afbe ipvs: reload ip header after head reallocation
gregkh/linux@edb0a2c6a663 Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal"
gregkh/linux@d49d420e4833 wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018
gregkh/linux@a63fa556ac57 drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
gregkh/linux@b05c2e25a5c1 bpf: Remove tst_run from lwt_seg6local_prog_ops.
gregkh/linux@b57a8983916f jfs: add check read-only before truncation in jfs_truncate_nolock()
gregkh/linux@469bd67fc338 jfs: add check read-only before txBeginAnon() call
gregkh/linux@19efa170e012 ibmvnic: Use kernel helpers for hex dumps
gregkh/linux@4a2de0f5b8d7 jfs: Fix null-ptr-deref in jfs_ioc_trim
gregkh/linux@ea27703eb0ef exfat: fix double free in delayed_free
gregkh/linux@9b03c3ce32a6 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
gregkh/linux@d8be1288e398 mISDN: hfcpci: Fix warning when deleting uninitialized timer
gregkh/linux@2c88069fac2c can: j1939: implement NETDEV_UNREGISTER notification handler
gregkh/linux@5e0de5cf9631 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
gregkh/linux@041ae05594f0 can: j1939: make j1939_sk_bind() fail if device is no longer registered
gregkh/linux@005a7173d8e4 smc: Fix use-after-free in __pnet_find_base_ndev().
gregkh/linux@b498f0da45a3 KVM: arm64: Prevent access to vCPU events before init
gregkh/linux@5a2fccc4b32c smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
gregkh/linux@3f119c37aa29 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
gregkh/linux@cd6b991de3e0 ASoC: nau8821: Cancel delayed work on component remove
gregkh/linux@fea55b034328 bpf: Fix use-after-free in offloaded map/prog info fill
gregkh/linux@f2d88b0d7aeb riscv: Fix register corruption from uninitialized cregs on error
gregkh/linux@3dfb3f82e043 Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
gregkh/linux@7dfc256a7d0c ASoC: nau8821: Cancel pending work before suspend
gregkh/linux@ff4a5b10fb4e smc: Use _sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
gregkh/linux@2a421e68c401 selinux: switch two allocations to use kzalloc_objs()
gregkh/linux@ca9ed69d038c Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
gregkh/linux@2a9717e2e9f0 Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
gregkh/linux@efb68671a7cb ASoC: tegra: Fix Master Volume Control
gregkh/linux@aa2ddcc65e85 block: make bio_check_eod work for zero sized devices
gregkh/linux@f48341830e42 mptcp: pm: fix memory leak from alloc-during-teardown race
gregkh/linux@ab6a99091811 ext4: propagate errors from fast commit range replay
gregkh/linux@0f2606a7c88c nilfs2: correct return value kernel-doc descriptions for ioctl functions
gregkh/linux@3bd064ccc70b nilfs2: reject invalid block index in GC ioctl
gregkh/linux@04e51353cb9f nfc: nci: add data_len bound checks to activation parameter extractors
gregkh/linux@4675a1279c44 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
gregkh/linux@8a10a624996f HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
gregkh/linux@29f556cf01a3 HID: magicmouse: re-enable multitouch after reset-resume
gregkh/linux@978df308a2b1 nvme: rename CDR/MORE/DNR to NVME_STATUS*
gregkh/linux@0952541b153e nvmet-tcp: bound SGL data length before allocating command buffers
gregkh/linux@c2f3d51c7f52 HID: nintendo: stop device IO before hid_hw_stop on probe failure
gregkh/linux@dc5108f18f58 HID: uclogic: fix use-after-free of inrange_timer on remove
gregkh/linux@21b4caf37519 HID: ft260: improve i2c write performance
gregkh/linux@85fc8d7a4395 HID: ft260: improve i2c large reads performance
gregkh/linux@d9cd8c259b8a HID: ft260: skip unexpected HID input reports
gregkh/linux@12363736643b HID: ft260: wake up device from power saving mode
gregkh/linux@65d6c17a1e39 HID: ft260: missed NACK from busy device
gregkh/linux@f9fa2e2dc026 HID: ft260: validate i2c input report length
gregkh/linux@90e9298f2e43 HID: ft260: fix stack-use-after-return write in I2C read race
gregkh/linux@163a91e3e8af Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
gregkh/linux@bb5f5414d1a6 Bluetooth: hci_sync: Fix accept list UAF during suspend
gregkh/linux@ac1a7c3deb7f Bluetooth: hci_conn: Fix not matching by CIS ID
gregkh/linux@a35c0b5a965d Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
gregkh/linux@8317afc5d532 Bluetooth: hci_event: fix Set CIG Parameters error status handling
gregkh/linux@9e05783d0bb9 Bluetooth: hci_event: validate LE Set CIG Parameters response
gregkh/linux@74b301f7f197 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
gregkh/linux@c6662f900b6b fpga: dfl: fme: add error handling
gregkh/linux@057b9feda326 accessibility: speakup: unregister tty ldisc on later init failures
gregkh/linux@9790f6e726ea usb: xhci: Handle USB3 port events when there is one roothub
gregkh/linux@43635ff6401c xhci: dbgtty: Fix unregister on tty_register_driver() failure
gregkh/linux@ce2d78f6f189 xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
gregkh/linux@03cfeeb13542 fuse: fix invalidate lock leak on setattr writeback failure
gregkh/linux@a61524da59a2 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
gregkh/linux@40102612180f usb: usbtest: disable dynamic ID support
gregkh/linux@178f59a0bccd usb: gadget: f_tcm: keep port count until LUN teardown completes
gregkh/linux@03ced5da6120 tls: device: fix out-of-bounds write in tls_append_frag()
gregkh/linux@4bc0dfa28dca xfrm: espintcp: fix UAF during close
gregkh/linux@6af5cdb03819 xfrm: drop ESP-in-TCP packets with no ingress device
gregkh/linux@1b7e066eabcc xfrm: ah6: validate routing header segments_left
gregkh/linux@ba0c110c2058 xfrm: fix xfrm_state_construct() auth-trunc leak
gregkh/linux@22226a2c3b90 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
gregkh/linux@9039e4f3e1c0 ipv6: seg6: clear IPv4 control block on IPIP decapsulation
gregkh/linux@993a31428da0 mm/swap: reject swapon() on filesystem-level encrypted files
gregkh/linux@978e45ae1672 crypto: atmel-tdes - use scatterlist length before DMA mapping
gregkh/linux@c9e0f06a0231 crypto: qce - fix CCM AAD buffer underallocation
gregkh/linux@e72a795df521 crypto: mxs-dcp - fix source scatterlist length access
gregkh/linux@531eeed53553 crypto: qce - Remove unsafe/deprecated algorithms
gregkh/linux@f6079dca67ec KVM: s390: vsie: zero stale crypto bits
gregkh/linux@ebf6edaf4871 Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
gregkh/linux@71cfda2fdf78 usb: core: Add lock to usb_wakeup_notification()
gregkh/linux@e4505facd9df usb: core: Strengthen error handling in hub_hub_status()
gregkh/linux@e9c00d7533f9 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
gregkh/linux@3f06f3f5b162 ALSA: usb-audio: Complete cleanup after system-resume errors
gregkh/linux@6b8cf5422c7e USB: serial: option: fix slab OOB read in interrupt URB callback
gregkh/linux@9a12c4813de4 USB: serial: spcp8x5: drop broken carrier detect support
gregkh/linux@bb572801290e USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
gregkh/linux@bd4bffc621a8 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
gregkh/linux@cf82dcca9634 Linux 6.1.187