Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 01 Feb 2024 09:05:49 +0100
Source: linux
Architecture: source
Version: 6.1.76-1
Distribution: bookworm
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1058887 1060005
Changes:
linux (6.1.76-1) bookworm; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.70
- bpf: Fix prog_array_map_poke_run map poke update
- HID: i2c-hid: acpi: Unify ACPI ID tables format
- HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[]
- drm/amd/display: fix hw rotated modes when PSR-SU is enabled
- [armhf] OMAP2+: Fix null pointer dereference and memory leak in
omap_soc_device_init
- reset: Fix crash when freeing non-existent optional resets
- [s390x] vx: fix save/restore of fpu kernel context
- wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
- wifi: mac80211: check if the existing link config remains unchanged
- wifi: mac80211: mesh: check element parsing succeeded
- wifi: mac80211: mesh_plink: fix matches_local logic
- Revert "net/mlx5e: fix double free of encap_header in update funcs"
- Revert "net/mlx5e: fix double free of encap_header"
- net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
- net/mlx5: Introduce and use opcode getter in command interface
- net/mlx5: Prevent high-rate FW commands from populating all slots
- net/mlx5: Re-organize mlx5_cmd struct
- net/mlx5e: Fix a race in command alloc flow
- net/mlx5e: fix a potential double-free in fs_udp_create_groups
- net/mlx5: Fix fw tracer first block check
- net/mlx5e: Correct snprintf truncation handling for fw_version buffer
- net/mlx5e: Correct snprintf truncation handling for fw_version buffer used
by representors
- [arm64] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and
above
- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
- net: sched: ife: fix potential use-after-free
- ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
- net/rose: fix races in rose_kill_by_device()
- Bluetooth: Fix deadlock in vhci_send_frame
- Bluetooth: hci_event: shut up a false-positive warning
- net: mana: select PAGE_POOL
- net: check vlan filter feature in vlan_vids_add_by_dev() and
vlan_vids_del_by_dev()
- afs: Fix the dynamic root's d_delete to always delete unused dentries
- afs: Fix dynamic root lookup DNS check
- net: check dev->gso_max_size in gso_features_check()
- keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
- afs: Fix overwriting of result of DNS query
- afs: Fix use-after-free due to get/remove race in volume tree
- [arm64,armhf] ASoC: hdmi-codec: fix missing report for jack initial status
- [arm64] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
- [armhf] i2c: aspeed: Handle the coalesced stop conditions with the start
conditions.
- gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
- nvme-pci: fix sleeping function called from interrupt context
- [x86] drm/i915/mtl: limit second scaler vertical scaling in ver >= 14
- [x86] drm/i915: Relocate intel_atomic_setup_scalers()
- [x86] drm/i915: Fix intel_atomic_setup_scalers() plane_state handling
- [x86] drm/i915/dpt: Only do the POT stride remap when using DPT
- [x86] drm/i915/mtl: Add MTL for remapping CCS FBs
- [x86] drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller
than the original
- iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
- interconnect: qcom: sm8250: Enable sync_state
- scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
- iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time
table
- [armhf] iio: adc: ti_am335x_adc: Fix return value check of
tiadc_request_dma()
- iio: triggered-buffer: prevent possible freeing of wrong buffer
- ALSA: usb-audio: Increase delay in MOTU M quirk
- usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
- wifi: cfg80211: Add my certificate
- wifi: cfg80211: fix certs build to not depend on file order
- USB: serial: ftdi_sio: update Actisense PIDs constant names
- USB: serial: option: add Quectel EG912Y module support
- USB: serial: option: add Foxconn T99W265 with new baseline
- USB: serial: option: add Quectel RM500Q R13 firmware support
- ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
- Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
- Bluetooth: L2CAP: Send reject on command corrupted request
- Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
- Bluetooth: Add more enc key size check
- net: usb: ax88179_178a: avoid failed operations when device is
disconnected
- [x86] Input: soc_button_array - add mapping for airplane mode button
- net: 9p: avoid freeing uninit memory in p9pdu_vreadf
- net: rfkill: gpio: set GPIO direction
- dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
- smb: client: fix OOB in cifsd when receiving compounded resps
- smb: client: fix potential OOB in cifs_dump_detail()
- smb: client: fix OOB in SMB2_query_info_init()
- smb: client: fix OOB in smbCalcSize() (CVE-2023-6606)
- [x86] drm/i915: Reject async flips with bigjoiner
- 9p: prevent read overrun in protocol dump tracepoint
- [riscv64] Fix do_notify_resume / do_work_pending prototype
- loop: do not enforce max_loop hard limit by (new) default
- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client
- Revert "drm/amd/display: Do not set DRR on pipe commit"
- btrfs: zoned: no longer count fresh BG region as zone unusable
- ubifs: fix possible dereference after free
- ublk: move ublk_cancel_dev() out of ub->mutex
- scsi: core: Always send batch on reset or error handling command
- tracing / synthetic: Disable events after testing in
synth_event_gen_test_init()
- dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
- pinctrl: starfive: jh7100: ignore disabled device tree nodes
- [armhf] bus: ti-sysc: Flush posted write only after srst_udelay
- lib/vsprintf: Fix %pfwf when current node refcount == 0
- [x86] thunderbolt: Fix memory leak in margining_port_remove()
- [arm64] KVM: arm64: vgic: Simplify kvm_vgic_destroy()
- [arm64] KVM: arm64: vgic: Add a non-locking primitive for
kvm_vgic_vcpu_destroy()
- [arm64] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
- [x86] alternatives: Sync core before enabling interrupts
- fuse: share lookup state between submount and its parent
- wifi: cfg80211: fix CQM for non-range use
- wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x)
- loop: deprecate autoloading callback loop_probe()
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.71
- ksmbd: replace one-element arrays with flexible-array members
- ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption
for this share
- ksmbd: use F_SETLK when unlocking a file
- ksmbd: Fix resource leak in smb2_lock()
- ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs
- ksmbd: Implements sess->rpc_handle_list as xarray
- ksmbd: fix typo, syncronous->synchronous
- ksmbd: Remove duplicated codes
- ksmbd: update Kconfig to note Kerberos support and fix indentation
- ksmbd: Fix spelling mistake "excceed" -> "exceeded"
- ksmbd: Fix parameter name and comment mismatch
- ksmbd: remove unused is_char_allowed function
- ksmbd: delete asynchronous work from list (CVE-2023-1193)
- ksmbd: set NegotiateContextCount once instead of every inc
- ksmbd: avoid duplicate negotiate ctx offset increments
- ksmbd: remove unused compression negotiate ctx packing
- fs: introduce lock_rename_child() helper
- ksmbd: fix racy issue from using ->d_parent and ->d_name
- ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename()
- ksmbd: fix uninitialized pointer read in smb2_create_link()
- ksmbd: call putname after using the last component
- ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
- ksmbd: add mnt_want_write to ksmbd vfs functions
- ksmbd: remove unused ksmbd_tree_conn_share function
- ksmbd: use kzalloc() instead of __GFP_ZERO
- ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked()
- ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void
- ksmbd: use kvzalloc instead of kvmalloc
- ksmbd: Replace the ternary conditional operator with min()
- ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect()
- ksmbd: Replace one-element array with flexible-array member
- ksmbd: Fix unsigned expression compared with zero
- ksmbd: check if a mount point is crossed during path lookup
- ksmbd: switch to use kmemdup_nul() helper
- ksmbd: add support for read compound
- ksmbd: fix wrong interim response on compound
- ksmbd: fix `force create mode' and `force directory mode'
- ksmbd: Fix one kernel-doc comment
- ksmbd: add missing calling smb2_set_err_rsp() on error
- ksmbd: remove experimental warning
- ksmbd: remove unneeded mark_inode_dirty in set_info_sec()
- ksmbd: fix passing freed memory 'aux_payload_buf'
- ksmbd: return invalid parameter error response if smb2 request is invalid
- ksmbd: check iov vector index in ksmbd_conn_write()
- ksmbd: fix race condition with fp
- ksmbd: fix race condition from parallel smb2 logoff requests
- ksmbd: fix race condition from parallel smb2 lock requests
- ksmbd: fix race condition between tree conn lookup and disconnect
- ksmbd: fix wrong error response status by using set_smb2_rsp_status()
- ksmbd: fix Null pointer dereferences in ksmbd_update_fstate()
- ksmbd: fix potential double free on smb2_read_pipe() error path
- ksmbd: Remove unused field in ksmbd_user struct
- ksmbd: reorganize ksmbd_iov_pin_rsp()
- ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr()
- ksmbd: fix recursive locking in vfs helpers
- ksmbd: fix missing RDMA-capable flag for IPoIB device in
ksmbd_rdma_capable_netdev()
- ksmbd: add support for surrogate pair conversion
- ksmbd: no need to wait for binded connection termination at logoff
- ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked()
- ksmbd: prevent memory leak on error return
- ksmbd: fix possible deadlock in smb2_open
- ksmbd: separately allocate ci per dentry
- ksmbd: move oplock handling after unlock parent dir
- ksmbd: release interim response after sending status pending response
- ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId
- ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error
- ksmbd: set epoch in create context v2 lease
- ksmbd: set v2 lease capability
- ksmbd: downgrade RWH lease caching state to RH for directory
- ksmbd: send v2 lease break notification for directory
- ksmbd: lazy v2 lease break on smb2_write()
- ksmbd: avoid duplicate opinfo_put() call on error of
smb21_lease_break_ack()
- ksmbd: fix wrong allocation size update in smb2_open()
- spi: Introduce spi_get_device_match_data() helper
- iio: imu: adis16475: add spi_device_id table
- nfsd: separate nfsd_last_thread() from nfsd_put()
- nfsd: call nfsd_last_thread() before final nfsd_put()
- linux/export: Ensure natural alignment of kcrctab array
- spi: Reintroduce spi_set_cs_timing()
- spi: Add APIs in spi core to set/get spi->chip_select and spi->cs_gpiod
- block: renumber QUEUE_FLAG_HW_WC
- ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() (CVE-2024-22705)
- mm/filemap: avoid buffered read/write race to read inconsistent data
- mm: migrate high-order folios in swap cache correctly
- mm/memory-failure: cast index to loff_t before shifting it
- mm/memory-failure: check the mapcount of the precise page
- ring-buffer: Fix wake ups when buffer_percent is set to 100
- tracing: Fix blocked reader of snapshot buffer
- ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
- ring-buffer: Fix slowpath of interrupted event
- NFSD: fix possible oops when nfsd/pool_stats is closed.
- spi: Constify spi parameters of chip select APIs
- device property: Allow const parameter to dev_fwnode()
- kallsyms: Make module_kallsyms_on_each_symbol generally available
- tracing/kprobes: Fix symbol counting logic by looking at modules as well
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.72
- keys, dns: Fix missing size check of V1 server-list header
- block: Don't invalidate pagecache for invalid falloc modes
- ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series
- ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook
- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6
- mptcp: prevent tcp diag from closing listener subflows
- Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"
- [x86] drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV,
G200SE
- cifs: cifs_chan_is_iface_active should be called with chan_lock held
- cifs: do not depend on release_iface for maintaining iface_list
- [x86] KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL
- wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ (Closes: #1058887)
- [arm64] drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in
AUX xfer
- netfilter: use skb_ip_totlen and iph_totlen
- netfilter: nf_tables: set transport offset from mac header for
netdev/egress
- nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to
llcp_local
- [x86] drm/i915/dp: Fix passing the correct DPCD_REV for
drm_dp_set_phy_test_pattern
- ice: Fix link_down_on_close message
- ice: Shut down VSI with "link-down-on-close" enabled
- i40e: Fix filter input checks to prevent config with invalid values
- igc: Report VLAN EtherType matching back to user
- igc: Check VLAN TCI mask
- igc: Check VLAN EtherType mask
- net: sched: em_text: fix possible memory leak in em_text_destroy()
- r8169: Fix PCI error on system resume
- can: raw: add support for SO_MARK
- net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps
- net: annotate data-races around sk->sk_tsflags
- net: annotate data-races around sk->sk_bind_phc
- net: Implement missing getsockopt(SO_TIMESTAMPING_NEW)
- [armhf] sun9i: smp: Fix array-index-out-of-bounds read in
sunxi_mc_smp_init
- sfc: fix a double-free bug in efx_probe_filters
- [arm64] net: bcmgenet: Fix FCS generation for fragmented skbuffs
- netfilter: nft_immediate: drop chain reference counter on error
- net: Save and restore msg_namelen in sock_sendmsg
- i40e: fix use-after-free in i40e_aqc_add_filters()
- [arm64] ASoC: meson: g12a-toacodec: Validate written enum values
- [arm64] ASoC: meson: g12a-tohdmitx: Validate written enum values
- [arm64] ASoC: meson: g12a-toacodec: Fix event generation
- [arm64] ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
- i40e: Restore VF MSI-X state during PCI reset
- igc: Fix hicredit calculation
- net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
- net/smc: fix invalid link access in dumping SMC-R connections
- asix: Add check for usbnet_get_endpoints
- bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
- net: Implement missing SO_TIMESTAMPING_NEW cmsg support
- cpu/SMT: Create topology_smt_thread_allowed()
- cpu/SMT: Make SMT control more robust against enumeration failures
- srcu: Fix callbacks acceleration mishandling
- [x86] bpf, x64: Fix tailcall infinite loop
- [x86] bpf, x86: Simplify the parsing logic of structure parameters
- [x86] bpf, x86: save/restore regs with BPF_DW size
- net: Declare MSG_SPLICE_PAGES internal sendmsg() flag
- udp: Convert udp_sendpage() to use MSG_SPLICE_PAGES
- splice, net: Add a splice_eof op to file-ops and socket-ops
- ipv4, ipv6: Use splice_eof() to flush
- udp: introduce udp->udp_flags
- udp: move udp->no_check6_tx to udp->udp_flags
- udp: move udp->no_check6_rx to udp->udp_flags
- udp: move udp->gro_enabled to udp->udp_flags
- udp: move udp->accept_udp_{l4|fraglist} to udp->udp_flags
- udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO
- udp: annotate data-races around udp->encap_type
- wifi: iwlwifi: yoyo: swap cdb and jacket bits values
- [arm64] dts: qcom: sdm845: align RPMh regulator nodes with bindings
- [arm64] dts: qcom: sdm845: Fix PSCI power domain names
- bpf: decouple prune and jump points
- bpf: remove unnecessary prune and jump points
- bpf: Remove unused insn_cnt argument from visit_[func_call_]insn()
- bpf: clean up visit_insn()'s instruction processing
- bpf: Support new 32bit offset jmp instruction
- bpf: handle ldimm64 properly in check_cfg()
- bpf: fix precision backtracking instruction iteration
- blk-mq: make sure active queue usage is held for bio_integrity_prep()
- net/mlx5: Increase size of irq name buffer
- [s390x] mm: add missing arch_set_page_dat() call to vmem_crst_alloc()
- [s390x] cpumf: support user space events for counting
- f2fs: clean up i_compress_flag and i_compress_level usage
- f2fs: convert to use bitmap API
- f2fs: assign default compression level
- f2fs: set the default compress_level on ioctl
- ext4: convert move_extent_per_page() to use folios
- khugepage: replace try_to_release_page() with filemap_release_folio()
- memory-failure: convert truncate_error_page() to use folio
- mm: merge folio_has_private()/filemap_release_folio() call pairs
- mm, netfs, fscache: stop read optimisation when folio removed from
pagecache
- filemap: add a per-mapping stable writes flag
- block: update the stable_writes flag in bdev_add
- smb: client: fix missing mode bits for SMB symlinks
- net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats
- dpaa2-eth: recycle the RX buffer only after all processing done
- ethtool: don't propagate EOPNOTSUPP from dumps
- bpf, sockmap: af_unix stream sockets need to hold ref for pair sock
- [arm64] firmware: arm_scmi: Fix frequency truncation by promoting
multiplier type
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7
- genirq/affinity: Remove the 'firstvec' parameter from
irq_build_affinity_masks
- genirq/affinity: Pass affinity managed mask array to
irq_build_affinity_masks
- genirq/affinity: Don't pass irq_affinity_desc array to
irq_build_affinity_masks
- genirq/affinity: Rename irq_build_affinity_masks as group_cpus_evenly
- genirq/affinity: Move group_cpus_evenly() into lib/
- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly
- mm/memory_hotplug: add missing mem_hotplug_lock
- mm/memory_hotplug: fix error handling in add_memory_resource()
- net: sched: call tcf_ct_params_free to free params in tcf_ct_init
- netfilter: flowtable: allow unidirectional rules
- netfilter: flowtable: cache info of last offload
- net/sched: act_ct: offload UDP NEW connections
- net/sched: act_ct: Fix promotion of offloaded unreplied tuple
- netfilter: flowtable: GC pushes back packets to classic path
- net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table
- btrfs: fix qgroup_free_reserved_data int overflow
- btrfs: mark the len field in struct btrfs_ordered_sum as unsigned
- ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
- firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines
and ASM108x/VT630x PCIe cards
- [x86] kprobes: fix incorrect return address calculation in
kprobe_emulate_call_indirect
- mm: fix unmap_mapping_range high bits shift bug
- drm/amdgpu: skip gpu_info fw loading on navi12
- drm/amd/display: add nv12 bounding box
- mmc: rpmb: fixes pause retune on all RPMB partitions.
- mmc: core: Cancel delayed work before releasing host
- genirq/affinity: Only build SMP-only helper functions on SMP kernels
- f2fs: compress: fix to assign compress_level for lz4 correctly
- net/sched: act_ct: additional checks for outdated flows
- net/sched: act_ct: Always fill offloading tuple iifidx
- bpf: Fix a verifier bug due to incorrect branch offset comparison with
cpu=v4
- bpf: syzkaller found null ptr deref in unix_bpf proto add
- smb3: Replace smb2pdu 1-element arrays with flex-arrays
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.73
- Revert "nfsd: call nfsd_last_thread() before final nfsd_put()"
- Revert "nfsd: separate nfsd_last_thread() from nfsd_put()"
- ipv6: remove max_size check inline with ipv4 (CVE-2023-52340)
- cifs: fix flushing folio regression for 6.1 backport (Closes: #1060005)
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.74
- f2fs: explicitly null-terminate the xattr list
- ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
- mptcp: fix uninit-value in mptcp_incoming_options
- wifi: cfg80211: lock wiphy mutex for rfkill poll
- wifi: avoid offset calculation on NULL pointer
- wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap
- debugfs: fix automount d_fsdata usage
- ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format
- nvme-core: fix a memory leak in nvme_ns_info_from_identify()
- drm/amd/display: update dcn315 lpddr pstate latency
- drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
- blk-mq: don't count completed flush data request as inflight in case of
quiesce
- nvme-core: check for too small lba shift
- [x86] ASoC: Intel: Skylake: Fix mem leak in few functions
- [x86] ASoC: Intel: Skylake: mem leak in skl register function
- ASoC: rt5650: add mutex to avoid the jack detection failure
- [x86] ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not
available
- nouveau/tu102: flush all pdbs on vmm flush
- [x86] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13
- [x86] ASoC: hdac_hda: Conditionally register dais for HDMI and Analog
- net/tg3: fix race condition in tg3_reset_task()
- ASoC: da7219: Support low DC impedance headset
- ASoC: ops: add correct range check for limiting volume
- nvme: introduce helper function to get ctrl state
- nvme: prevent potential spectre v1 gadget
- [arm64] dts: rockchip: Fix PCI node addresses on rk3399-gru
- drm/amdgpu: Add NULL checks for function pointers
- [armhf] drm/exynos: fix a potential error pointer dereference
- [armhf] drm/exynos: fix a wrong error checking
- [x86] hwmon: (corsair-psu) Fix probe when built-in
- [arm64] clk: rockchip: rk3568: Add PLL rate for 292.5MHz
- [armhf] clk: rockchip: rk3128: Fix HCLK_OTG gate register
- jbd2: correct the printing of write_flags in jbd2_write_superblock()
- jbd2: increase the journal IO's priority
- drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
- neighbour: Don't let neigh_forced_gc() disable preemption for long
- [x86] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
- jbd2: fix soft lockup in journal_finish_inode_data_buffers()
- tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
- tracing: Add size check when printing trace_marker output
- tracing: Fix uaf issue when open the hist or hist_debug file
- ring-buffer: Do not record in NMI if the arch does not support cmpxchg in
NMI
- Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1
- [arm64] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
- Input: atkbd - skip ATKBD_CMD_GETID in translated mode
- Input: i8042 - add nomux quirk for Acer P459-G2-M
- [s390x] scm: fix virtual vs physical address confusion
- wifi: iwlwifi: pcie: avoid a NULL pointer dereference
- Input: xpad - add Razer Wolverine V2 support
- HID: nintendo: fix initializer element is not constant error
- [x86] platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some
ThinkPad systems
- [x86] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
- [x86] ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk
- ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models
- dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM
- HID: nintendo: Prevent divide-by-zero on code
- smb: client: fix potential OOB in smb2_dump_detail() (CVE-2023-6610)
- [arm64,armhf] i2c: rk3x: fix potential spinlock recursion on poll
- drm/amd/display: get dprefclk ss info from integration info table
- ida: Fix crash in ida_free when the bitmap is empty (CVE-2023-6915)
- virtio_blk: fix snprintf truncation compiler warning
- net: qrtr: ns: Return 0 if server port is not present
- [armhf] sun9i: smp: fix return code check of of_property_match_string
- drm/crtc: fix uninitialized variable use
- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx
- ACPI: resource: Add another DMI match for the TongFang GMxXGxx
- [x86] ASoC: SOF: Intel: hda-codec: Delay the codec device registration
- btf, scripts: Exclude Rust CUs with pahole
- bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to
pahole flags for v1.25
- ksmbd: don't allow O_TRUNC open on read-only share
- ksmbd: free ppace array on error in parse_dacl
- Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
- [arm*] binder: use EPOLLERR from eventpoll.h
- [arm*] binder: fix use-after-free in shinker's callback
- [arm*] binder: fix trivial typo of binder_free_buf_locked()
- [arm*] binder: fix comment on binder_alloc_new_buf() return value
- uio: Fix use-after-free in uio_open
- parport: parport_serial: Add Brainboxes BAR details
- parport: parport_serial: Add Brainboxes device IDs and geometry
- PCI: Add ACS quirk for more Zhaoxin Root Ports
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.75
- [x86] lib: Fix overflow when counting digits
- [x86] mce/inject: Clear test status value
- [arm64] EDAC/thunderx: Fix possible out-of-bounds string access
- [powerpc*] remove checks for binutils older than 2.25
- [powerpc*] add crtsavres.o to always-y instead of extra-y
- [powerpc*] 44x: select I2C for CURRITUCK
- [powerpc*] pseries/memhp: Fix access beyond end of drmem array
- [powerpc*] powernv: Add a null pointer check to scom_debug_init_one()
- [powerpc*] powernv: Add a null pointer check in opal_event_init()
- [powerpc*] powernv: Add a null pointer check in opal_powercap_init()
- [powerpc*] imc-pmu: Add a null pointer check in update_events_in_group()
- ACPI: video: check for error while searching for backlight device parent
- ACPI: LPIT: Avoid u32 multiplication overflow
- KEYS: encrypted: Add check for strsep
- [x86] platform/x86/intel/vsec: Enhance and Export intel_vsec_add_aux()
- [x86] platform/x86/intel/vsec: Support private data
- [x86] platform/x86/intel/vsec: Use mutex for ida_alloc() and ida_free()
- [x86] platform/x86/intel/vsec: Fix xa_alloc memory leak
- of: Add of_property_present() helper
- cpufreq: Use of_property_present() for testing DT property presence
- cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
- calipso: fix memory leak in netlbl_calipso_add_pass()
- efivarfs: force RO when remounting if SetVariable is not supported
- efivarfs: Free s_fs_info on unmount
- ACPI: LPSS: Fix the fractional clock divider flags
- ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the
error
- mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
- selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
- crypto: virtio - Handle dataq logic with tasklet
- [x86] crypto: ccp - fix memleak in ccp_init_dm_workarea
- crypto: af_alg - Disallow multiple in-flight AIO requests
- [arm64] crypto: safexcel - Add error handling for dma_map_sg() calls
- crypto: hisilicon/qm - save capability registers in qm init process
- crypto: hisilicon/zip - add zip comp high perf mode configuration
- crypto: hisilicon/qm - add a function to set qm algs
- crypto: hisilicon/hpre - save capability registers in probe process
- crypto: hisilicon/sec2 - save capability registers in probe process
- crypto: hisilicon/zip - save capability registers in probe process
- pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
- erofs: fix memory leak on short-lived bounced pages
- fs: indicate request originates from old mount API
- gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
- crypto: virtio - Wait for tasklet to complete on device remove
- crypto: scomp - fix req->dst buffer overflow
- csky: fix arch_jump_label_transform_static override
- blocklayoutdriver: Fix reference leak of pnfs_device_node
- NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
- SUNRPC: fix _xprt_switch_find_current_entry logic
- pNFS: Fix the pnfs block driver's calculation of layoutget size
- wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async()
- wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
- bpf, lpm: Fix check prefixlen before walking trie
- bpf: Add crosstask check to __bpf_get_stack
- wifi: ath11k: Defer on rproc_get failure
- wifi: libertas: stop selecting wext
- [armhf] net/ncsi: Fix netlink major/minor version numbers
- [arm64] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
- [arm64] firmware: meson_sm: populate platform devices from sm device tree
data
- wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
- md: synchronize flush io with array reconfiguration
- bpf: enforce precision of R0 on callback return
- rcu-tasks: Provide rcu_trace_implies_rcu_gp()
- bpf: add percpu stats for bpf_map elements insertions/deletions
- bpf: Add map and need_defer parameters to .map_fd_put_ptr()
- bpf: Defer the free of inner map when necessary
- bpf: fix check for attempt to corrupt spilled pointer
- scsi: fnic: Return error if vmalloc() failed
- [arm64] dts: qcom: qrb5165-rb5: correct LED panic indicator
- [arm64] dts: qcom: sdm845-db845c: correct LED panic indicator
- bpf: Fix verification of indirect var-off stack access

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)