[continued from previous message]

- nilfs2: protect references to superblock parameters exposed in sysfs
- nilfs2: fix state management in error path of log writing function
- ALSA: control: Apply sanity check of input values for user elements
- ALSA: hda: Add input value sanity checks to HDMI channel map controls
- smack: unix sockets: fix accept()ed socket label
- ELF: fix kernel.randomize_va_space double read
- [armhf] irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
- af_unix: Remove put_pid()/put_cred() in copy_peercred().
- [x86] kmsan: Fix hook for unaligned accesses
- netfilter: nf_conncount: fix wrong variable type
- udf: Avoid excessive partition lengths
- media: vivid: fix wrong sizeimage value for mplane
- leds: spi-byte: Call of_node_put() on error path
- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
- usb: uas: set host status byte on data completion error
- usb: gadget: aspeed_udc: validate endpoint index for ast udc
- drm/amd/display: Check HDCP returned status
- drm/amdgpu: Fix smatch static checker warning
- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
- media: vivid: don't set HDMI TX controls if there are no HDMI outputs
- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
- Input: ili210x - use kvmalloc() to allocate buffer for firmware update
- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
- pcmcia: Use resource_size function on resource object
- drm/amd/display: Check denominator pbn_div before used
- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
- can: bcm: Remove proc entry when dev is unregistered.
- [arm64] can: m_can: Release irq on error in m_can_open
- can: mcp251xfd: fix ring configuration when switching from CAN-CC to
CAN-FD mode
- cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
- igb: Fix not clearing TimeSync interrupts for 82580
- ice: Add netif_device_attach/detach into PF reset flow
- [x86] platform/x86: dell-smbios: Fix error path in dell_smbios_init()
- regulator: Add of_regulator_bulk_get_all
- regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
- igc: Unlock on error in igc_io_resume()
- ice: Use ice_max_xdp_frame_size() in ice_xdp_setup_prog()
- ice: allow hot-swapping XDP programs
- ice: do not bring the VSI up, if it was down before the XDP setup
- usbnet: modern method to get random MAC
- bareudp: Fix device stats updates.
- fou: Fix null-ptr-deref in GRO.
- net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
- net: dsa: vsc73xx: fix possible subblocks range of CAPT block
- firmware: cs_dsp: Don't allow writes to read-only controls
- [arm64] phy: zynqmp: Take the phy mutex in xlate
- [x86] ASoC: topology: Properly initialize soc_enum values
- dm init: Handle minors larger than 255
- [amd64] iommu/vt-d: Handle volatile descriptor status read
- cgroup: Protect css->cgroup write under css_set_lock
- devres: Initialize an uninitialized struct member
- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
- [x86] crypto: qat - fix unintentional re-enabling of error interrupts
- hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
- libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
- drm/amdgpu: Set no_hw_access when VF request full GPU fails
- ext4: fix possible tid_t sequence overflows
- dma-mapping: benchmark: Don't starve others when doing the test
- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
- smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
- btrfs: replace BUG_ON with ASSERT in walk_down_proc()
- btrfs: clean up our handling of refs == 0 in snapshot delete
- btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
- PCI: Add missing bridge lock to pci_bus_lock()
- tcp: Don't drop SYN+ACK for simultaneous connect().
- net: dpaa: avoid on-stack arrays of NR_CPUS elements
- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
- btrfs: initialize location to fix -Wmaybe-uninitialized in
btrfs_lookup_dentry()
- [s390x] vmlinux.lds.S: Move ro_after_init section behind rodata section
- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
- [amd64] HID: amd_sfh: free driver_data after destroying hid device
- Input: uinput - reject requests with unreasonable number of slots
- usbnet: ipheth: race between ipheth_close and error handling
- Squashfs: sanity check symbolic link size
- of/irq: Prevent device address out-of-bounds read in interrupt map walk
- lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
- [mips*] cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
- ata: pata_macio: Use WARN instead of BUG
- NFSv4: Add missing rescheduling points in
nfs_client_return_marked_delegations
- io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers
- io_uring/sqpoll: Do not set PF_NO_SETAFFINITY on sqpoll threads
- tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
- iio: buffer-dmaengine: fix releasing dma channel on error
- iio: fix scale application in iio_convert_raw_to_processed_unlocked
- iio: adc: ad7124: fix config comparison
- iio: adc: ad7606: remove frstdata check for serial mode
- iio: adc: ad7124: fix chip ID mismatch
- [arm64,armhf] usb: dwc3: core: update LC timer as per USB Spec V3.2
- [arm*] binder: fix UAF caused by offsets overwrite
- nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
- VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
- clocksource/drivers/timer-of: Remove percpu irq related code
- uprobes: Use kzalloc to allocate xol area
- perf/aux: Fix AUX buffer serialization (CVE-2024-46713)
- fuse: add "expire only" mode to FUSE_NOTIFY_INVAL_ENTRY
- fuse: allow non-extending parallel direct writes on the same file
- fuse: add request extension
- fuse: fix memory leak in fuse_create_open
- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
- workqueue: wq_watchdog_touch is always called with valid CPU
- workqueue: Improve scalability of workqueue watchdog touch
- ACPI: processor: Return an error if acpi_processor_get_info() fails in
processor_add()
- ACPI: processor: Fix memory leaks in error paths of processor_add()
- [arm64] acpi: Move get_cpu_for_acpi_id() to a header
- [arm64] acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
- can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate
function
- can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index
erratum
- can: mcp251xfd: clarify the meaning of timestamp
- can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
- drm/amd: Add gfx12 swizzle mode defs
- drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
- [powerpc*] 64e: remove unused IBM HTW code
- [powerpc*] 64e: split out nohash Book3E 64-bit code
- [powerpc*] 64e: Define mmu_pte_psize static
- nvmet-tcp: fix kernel crash if commands allocation fails
- [x86] ASoc: SOF: topology: Clear SOF link platform name upon unload
- [arm64,armhf] ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
- [x86] drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
- [x86] drm/i915/fence: Mark debug_fence_free() with __maybe_unused
- [arm64,armhf] gpio: rockchip: fix OF node leak in probe()
- [arm64] gpio: modepin: Enable module autoloading
- [x86] mm: Fix PTI for i386 some more
- btrfs: fix race between direct IO write and fsync when using same fd
- bpf: Silence a warning in btf_type_id_size()
- memcg: protect concurrent access to mem_cgroup_idr (CVE-2024-43892)
- regulator: of: fix a NULL vs IS_ERR() check in of_regulator_bulk_get_all()
- fuse: add feature flag for expire-only
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.111
- ksmbd: override fsids for share path check
- ksmbd: override fsids for smb2_query_info()
- usbnet: ipheth: fix carrier detection in modes 1 and 4
- net: ethernet: use ip_hdrlen() instead of bit shift
- drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
- drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
- net: phy: vitesse: repair vsc73xx autonegotiation
- [powerpc*] mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
- btrfs: update target inode's ctime on unlink
- Input: ads7846 - ratelimit the spi_sync error message
- Input: synaptics - enable SMBus for HP Elitebook 840 G2
- HID: multitouch: Add support for GT7868Q
- scripts: kconfig: merge_config: config files: add a trailing newline
- [x86] platform/surface: aggregator_registry: Add Support for Surface Pro
10
- [x86] platform/surface: aggregator_registry: Add support for Surface
Laptop Go 3
- [arm64] drm/msm/adreno: Fix error return if missing firmware-name
- Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
- smb/server: fix return value of smb2_open()
- NFSv4: Fix clearing of layout segments in layoutreturn
- NFS: Avoid unnecessary rescanning of the per-server delegation list
- [x86] platform/x86: panasonic-laptop: Fix SINF array out of bounds
accesses
- [x86] platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf
array
- mptcp: pm: Fix uaf in __timer_delete_sync
- [arm64] dts: rockchip: fix eMMC/SPI corruption when audio has been used on
RK3399 Puma
- [arm64] dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399
Puma
- net: tighten bad gso csum offset check in virtio_net_hdr
- dm-integrity: fix a race condition when accessing recalc_sector
- mm: avoid leaving partial pfn mappings around in error case
- pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
(CVE-2024-35943)
- [arm64] dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E
- eeprom: digsy_mtc: Fix 93xx46 driver probe failure
- cxl/core: Fix incorrect vendor debug UUID define
- [armhf] hwmon: (pmbus) Conditionally clear individual status bits for
pmbus rev >= 1.2
- ice: fix accounting for filters shared by multiple VSIs
- igb: Always call igb_xdp_ring_update_tail() under Tx lock
- net/mlx5: Update the list of the PCI supported devices
- net/mlx5e: Add missing link modes to ptys2ethtool_map
- net/mlx5: Explicitly set scheduling element and TSAR type
- net/mlx5: Add missing masks and QoS bit masks for scheduling elements
- net/mlx5: Correct TASR typo into TSAR
- net/mlx5: Verify support for scheduling element and TSAR type
- net/mlx5: Fix bridge mode operations when there are no VFs
- fou: fix initialization of grc
- netfilter: nft_socket: fix sk refcount leaks
- net: dpaa: Pad packets to ETH_ZLEN
- [arm64] spi: nxp-fspi: fix the KASAN report out-of-bounds bug
- soundwire: stream: Revert "soundwire: stream: fix programming slave ports
for non-continous port maps"
- dma-buf: heaps: Fix off-by-one in CMA heap fault handler
- drm/amdgpu/atomfirmware: Silence UBSAN warning
- [x86] drm/i915/guc: prevent a possible int overflow in wq offsets
- pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID
- [arm64] ASoC: meson: axg-card: fix 'use-after-free'
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.112
- ALSA: hda/realtek - Fixed ALC256 headphone no sound
- ALSA: hda/realtek - FIxed ALC285 headphone no sound
- scsi: lpfc: Fix overflow build issue
- [x86] hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
- [armhf] net: ftgmac100: Ensure tx descriptor updates are visible
- wifi: iwlwifi: lower message level for FW buffer destination
- wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
- wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
- wifi: iwlwifi: clear trans->state earlier upon error
- can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
- [x86] ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match
less strict
- [x86] ASoC: intel: fix module autoloading
- spi: spidev: Add an entry for elgin,jg10309-01
- spi: bcm63xx: Enable module autoloading
- smb: client: fix hang in wait_for_response() for negproto
- [x86] hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides
frequency
- tools: hv: rm .*.cmd when make clean
- block: Fix where bio IO priority gets set
- spi: spidev: Add missing spi_device_id for jg10309-01
- ocfs2: add bounds checking to ocfs2_xattr_find_entry()
- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
(CVE-2024-41016)
- xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING
- xfs: Fix deadlock on xfs_inodegc_worker
- xfs: fix extent busy updating
- xfs: don't use BMBT btree split workers for IO completion
- xfs: fix low space alloc deadlock
- xfs: prefer free inodes at ENOSPC over chunk allocation
- xfs: block reservation too large for minleft allocation
- xfs: fix uninitialized variable access
- xfs: quotacheck failure can race with background inode inactivation
- xfs: fix BUG_ON in xfs_getbmap()
- xfs: buffer pins need to hold a buffer reference
- xfs: defered work could create precommits
- xfs: fix AGF vs inode cluster buffer deadlock
- xfs: collect errors from inodegc for unlinked inode recovery
- xfs: fix ag count overflow during growfs
- xfs: remove WARN when dquot cache insertion fails
- xfs: fix the calculation for "end" and "length"
- xfs: load uncached unlinked inodes into memory on demand
- xfs: fix negative array access in xfs_getbmap
- xfs: fix unlink vs cluster buffer instantiation race
- xfs: correct calculation for agend and blockcount
- xfs: use i_prev_unlinked to distinguish inodes that are not on the
unlinked list
- xfs: reload entire unlinked bucket lists
- xfs: make inode unlinked bucket recovery work with quotacheck
- xfs: fix reloading entire unlinked bucket lists
- xfs: set bnobt/cntbt numrecs correctly when formatting new AGs
- xfs: journal geometry is not properly bounds checked
- netfilter: nft_socket: make cgroupsv2 matching work with namespaces
- netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in
nft_socket_cgroup_subtree_level()
- netfilter: nft_set_pipapo: walk over current view on netlink dump
(CVE-2024-27017)
- netfilter: nf_tables: missing iterator type in lookup walk
- Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"
- gpiolib: cdev: Ignore reconfiguration without direction
- gpio: prevent potential speculation leaks in gpio_device_get_desc()
(CVE-2024-44931)
- can: mcp251xfd: properly indent labels
- can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
mcp251xfd_chip_start/stop()
- btrfs: calculate the right space for delayed refs when updating global
reserve
- [x86] powercap: RAPL: fix invalid initialization for pl4_supported field
- [x86] mm: Switch to new Intel CPU model defines
- USB: serial: pl2303: add device id for Macrosilicon MS3020
- USB: usbtmc: prevent kernel-usb-infoleak
.
[ Salvatore Bonaccorso ]
* Bump ABI to 26
* [rt] Update to 6.1.107-rt39
* [rt] Update to 6.1.111-rt42
Checksums-Sha1:
38e3b8df00a69093f31fd98aa7aca06bc4db78bc 14042 linux-signed-i386_6.1.112+1.dsc
887d7596ede43ec0ea3b59fc6b6ce341e99f1bf5 4094220 linux-signed-i386_6.1.112+1.tar.xz
Checksums-Sha256:
b9f63ac2433b7095c3c719f2fbb11191d87e6f71322f4cb1a069697dd73761c3 14042 linux-signed-i386_6.1.112+1.dsc
7e0fa1b6938a55e9924e430ffc19b6a34e324addc4041d094dea02e6dd225659 4094220 linux-signed-i386_6.1.112+1.tar.xz
Files:
91bfae810cd188ebe61e39b07461cd73 14042 kernel optional linux-signed-i386_6.1.112+1.dsc
54365c9446b2a7061f0a38bed007898a 4094220 kernel optional linux-signed-i386_6.1.112+1.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfKFfvHEI+gkU+E+di0FRiLdONzYFAmb8L0oACgkQi0FRiLdO NzZx4w/7B4jNX2fesXcPtyxNZTVIYWzjiBCNP9vB5MA0DEQAQVqvQj6ckdwLFiUp F8TA18lVQ4qTSPCcNcRAMjauxX4vaO45nySB9SuBqoqnVLF+SGZgoqZpuigo/Yme HFaIexgGh1RZLAlbb5unpUzlovBt7R8OBbbxzkFlylX7Hq7rT39BP0CfrCwy0g4J v+z5aA7uv+JgHm4CZJ1cVO//eU3g7/jb5WPILxoQI4xEtSrEL+tqledf6txtEiaL 1ZpkknVZfK0Ruw/r5kfjgYm64Lm47RatnWIGg4tM/PaaAPZtcR9PWTiQNGi8I7kf 8y4YeKAHVd2GHASvB5CeqgCUQ0IUaAHVhE8d1XTRgr1aLQAh6JWN7xJabLTq3HAZ hYJvR9oTJj8q97y889Cs3fduc59vAx7UjP1hwVhsUGCtMD/E4d/WJZhHykh7s8jM SzJrC8ztDhFm48aDvIDvVM9JI01bwvJ6YLjS+DPo0vt+VSWjCTSNGXqnL8osLXzP m4KyUuxxKHTSWeOoHVglQJuU7ju1CFcFgNNiZAXvlDmSFYKw9Sd6iYnKQjhYvYbE Du4+sUtkmUUirt6+lCx7WSxEJbqcXC2TbG+3kQ+e4M6qxrn7w4OQt6BDO6qj7TwX C5YNHPphYdJArOyixbrAB1y6tHLrixylV/Q8jJzIyZovUVxp+Q8=
=gGmd
-----END PGP SIGNATURE-----


--==============D58705695468650639=Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCZwK8kQAKCRCb9qggYcy5 IXYuAP4gcwA7ZyW5RMVxc1kl+EVO3D3T7QtGMI2+/iiOp75HtQEAy39p1CZa8DPO 4QsAQM36tUYhaub5HQpCz9r44/7OmAI=Z+PE
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)