https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.6-rc1.gz This is the start of the stable review cycle for the 7.1.6 release. There are 744 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:38 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 7.1.6-rc1 Nikunj A Dadhania KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug Willem de Bruijn selftests: drv-net: so_txtime: relax variance bounds Willem de Bruijn selftests: drv-net: cope with slow env in so_txtime.py test Andrea Righi sched_ext: Preserve rq tracking across local DSQ dispatch Tejun Heo sched_ext: Move shared helpers from ext.c into internal.h and cid.h Breno Leitao bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Shradha Gupta net: mana: Optimize irq affinity for low vcpu configs Michael Bommarito thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg thunderbolt: Remove service debugfs entries during unregister Mika Westerberg thunderbolt: Keep XDomain reference during the lifetime of a service Muchun Song mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization Muchun Song mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths Chuck Lever SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Darrick J. Wong xfs: don't replace the wrong part of the cow fork Joanne Koong fuse-uring: fix race between registration and connection abortion Ricardo Robaina audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina audit: use 'unsigned int' instead of 'unsigned' Harry Wentland drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources Namjae Jeon ksmbd: validate ACE size against SID sub-authorities Namjae Jeon ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Matthieu Baerts (NGI0) selftests: drv-net: add missing kconfig for psp.py Christian König drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx Yang Wang drm/amd/pm: fix smu13 power limit range calculation Asad Kamal drm/amdgpu: fix aperture mapping leak Zhu Lingshan drm/amdgpu: reject mapping a reserved doorbell to a new queue Ce Sun drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Ce Sun drm/amdgpu: fix resource leak on ACP reset timeout Harish Kasiviswanathan drm/amdgpu: Fix kernel panic during driver load failure Boyuan Zhang drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang drm/amdgpu/vce: fix integer overflow in image size Alex Deucher drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Prike Liang drm/amdgpu/mes11: set doorbell offset for suspending userq Boyuan Zhang drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection Boyuan Zhang drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection Alex Deucher drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() Jesse Zhang drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq Jesse Zhang drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq Alex Deucher drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang drm/amd/pm: make pp_features read-only when scpm is enabled Yang Wang drm/amd/pm: fix amdgpu_pm_info power display units Ethan Nelson-Moore watchdog: s32g_wdt: remove incorrect options in watchdog_info struct James Raphael Tiovalen vxlan: mdb: Fix source list corruption on a failed replace Stefano Garzarella vsock/virtio: collapse receive queue under memory pressure Daehyeon Ko <4ncienth@gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Yuxiang Yang tcp: challenge ACK for non-exact RST in SYN-RECEIVED Yizhou Zhao tcp: initialize standalone TCP-AO response padding Justin Lai rtase: Workaround for TX hang caused by hardware packet parsing Asim Viladi Oglu Manizada pppoe: reload header pointer after dev_hard_header() Shuvam Pandey ovpn: hold peer before scheduling keepalive work Pavitra Jha ovpn: fix peer refcount leak in TCP error paths Kyle Zeng openvswitch: fix GSO userspace truncation underflow Doruk Tan Ozturk mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov mac802154: hold an interface reference across the scan worker Michael Bommarito ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov ice: use READ_ONCE() to access cached PHC time Aleksandr Loktionov ice: reject out-of-range ptype in ice_parser_profile_init Eddie Phillips gve: fix Rx queue stall on alloc failure Namjae Jeon ksmbd: validate minimum PDU size for transform requests James Montgomery ksmbd: defer destroy_previous_session() until after NTLM authentication Carl Johnson smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target Raphael Zimmer rbd: Reset positive result codes to zero in object map update path Christian Brauner super: fix emergency thaw deadlock on frozen block devices Masami Hiramatsu (Google) selftests/ftrace: Reset triggers at top level before instance loop Paul Greenwalt ice: fix PTP Call Trace during PTP release Sven Schnelle ptp: ptp_s390: Add missing facility check Jann Horn proc: Fix broken error paths for namespace links Youssef Samir net: qrtr: ns: Raise node count limit to 512 Coia Prant net: pcs: xpcs: fix SGMII state reading Fan Wu net: hip04: fix RX buffer leak on build_skb failure Shiming Cheng net: gro: fix double aggregation of flush-marked skbs David Lee net/x25: fix use-after-free in x25_kill_by_neigh() Aldo Ariel Panzardo net/sched: serialize qdisc_rtab_list against concurrent get/put Manjunath Patil net/mlx5e: Use sender devcom for MPV master-up Bryam Vargas net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm@gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao phonet: pep: fix use-after-free in pep_get_sb() Markus Breitenberger net: stmmac: intel: skip SerDes reconfig when rate is unchanged Harry Yoo (Oracle) mm/slab: fix a memory leak due to bootstrapping sheaves twice Shengming Hu mm/slub: fix lost local objects when bulk remote free batch fills Lu Baolu iommu/vt-d: Disallow SVA if page walk is not coherent Zhang Yi iomap: fix out-of-bounds bitmap_set() with zero-length range Yitang Yang io_uring/rw: fix missing ERESTARTSYS conversion in read paths Tengda Wu ftrace: Add global mutex to serialize trace_parser access Eric Biggers fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Eric Biggers fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Chen Changcheng fs/super: fix emergency thaw double-unlock of s_umount Christian Brauner binfmt_elf_fdpic: only honour the first PT_INTERP Chancel Liu ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Chancel Liu ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown Shihuang Liu amt: fix use-after-free in AMT delayed works Douya Le libceph: remove debugfs files before client teardown Douya Le libceph: reject zero bucket types in crush_decode Raphael Zimmer libceph: Reject monmaps advertising zero monitors Shuangpeng Bai libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang libceph: guard missing CRUSH type name lookup Pavitra Jha libceph: fix two unsafe bare decodes in decode_lockers() Raphael Zimmer libceph: Fix multiplication overflow in decode_new_up_state_weight() Xiang Mei libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Douya Le libceph: bound get_version reply decode to front len Wentao Liang ceph: fix writeback_count leak in write_folio_nounlock() WenTao Liang ceph: fix refcount leak in ceph_readdir() Bryam Vargas ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Zhiling Zou sctp: close UDP tunnel sockets during netns teardown Zhiling Zou sctp: avoid auth_enable sysctl UAF during netns teardown Jun Yang sctp: don't free the ASCONF's own transport in DEL-IP processing Rik van Riel mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established Wei Yang mm/page_vma_mapped: fix device-private PMD handling Xie Yuanbin mm/memory-failure: trace: change memory_failure_event to ras subsystem Breno Leitao mm/kmemleak: fix checksum computation for per-cpu objects SJ Park mm/damon/core: disallow overlapping input ranges for damon_set_regions() Thomas Weißschuh m68k: avoid -Wunused-but-set-parameter in clear_user_page() SJ Park mm/damon/core: validate ranges in damon_set_regions() Mike Rapoport (Microsoft) userfaultfd: prevent registration of special VMAs Qu Wenruo btrfs: do not try compression for data reloc inodes David Howells afs: Fix afs_edit_dir_remove() to get, not find, block 0 Geliang Tang selftests: mptcp: userspace_pm: fix undefined variable port Geliang Tang mptcp: pm: userspace: fix use-after-free in get_local_id Michael Bommarito mptcp: only set DATA_FIN when a mapping is present Kalpan Jani mptcp: fix stale skb->sk reference on subflow close Matthieu Baerts (NGI0) mptcp: fix BUILD_BUG_ON on legacy ARM config Chenguang Zhao mptcp: decrement subflows counter on failed passive join Will Deacon Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Dev Jain arm64: make huge_ptep_get handled unaligned addresses Fuad Tabba tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() Masami Hiramatsu (Google) tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Ming Lei ublk: wait on ublk_dev_ready() instead of ub->completion Jackie Liu tracing: Propagate errors from remote event bulk updates Steven Rostedt tracing: perf: Fix stale head for perf syscall tracing Masami Hiramatsu (Google) tracing: Fix union collision of module and refcnt for dynamic events deepakraog tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Usama Arif tracing: Fix context switch counter truncation Steven Rostedt tracing: Delay module ref count for "enable_event" trigger Xu Rao misc: nsm: pin the module while the device is open Runyu Xiao misc: nsm: only unlock nsm_dev on post-lock error paths Guangshuo Li intel_th: fix MSC output device reference leak Alexander Usyskin mei: bus: access mei_device under device_lock on cleanup Ethan Nelson-Moore selftests: ntsync: correct CONFIG_NTSYNC name Jiangshan Yi serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve serial: sc16is7xx: implement gpio get_direction() callback Ben Hutchings uio_hv_generic: Bind to FCopy device by default Ian Abbott comedi: comedi_parport: deal with premature interrupt Nathan Chancellor x86/boot/compressed: Disable jump tables Adrian Ng Ho Yin firmware: stratix10-svc: handle NO_RESPONSE in async poll Adrian Ng Ho Yin firmware: stratix10-svc: fix teardown order in remove to prevent race Tze Yee Ng firmware: stratix10-svc: fix memory leaks and list corruption bugs Cen Zhang (Microsoft) rhashtable: clear stale iter->p on table restart Xu Rao cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Rong Bao LoongArch: Retrieve CPU package ID from PPTT when available Kanglong Wang LoongArch: Move jump_label_init() before parse_early_param() Huacai Chen LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT Haoran Jiang LoongArch: Fix oops during single-step debugging Huacai Chen LoongArch: Fix build errors due to wrong instructions for 32BIT George Guo LoongArch: Fix address space mismatch in kexec command line lookup Miguel Ojeda objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Alexandre Courbot rust: allow `clippy::unwrap_or_default` globally Miguel Ojeda rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 Alice Ryhl rust: device: avoid trailing ; in printing macros FUJITA Tomonori rust: time: fix as_micros_ceil() to round correctly for negative Delta Alice Ryhl rust_binder: only print failure if error has source Zixing Liu platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Jose Ignacio Tornos Martinez wifi: ath12k: fix NULL pointer dereference in rhash table destroy Wentao Liang wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() LiangCheng Wang wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Fan Wu wifi: brcmfmac: make release_scratchbuffers idempotent Fan Wu wifi: brcmfmac: drain bus_reset work on device removal Devin Wittmayer wifi: mt76: restrict NPU/PPE active checks to MMIO devices Devin Wittmayer wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Daniel Hodges wifi: ath6kl: fix use-after-free in aggr_reset_state() Tristan Madani wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei ALSA: timer: don't re-enter an instance callback that is still running Norbert Szetei ALSA: timer: drain a slave's callback before its master detaches it Kai Vehmanen ALSA: hda: codecs: hdmi: disable keep-alive before audio format change Norbert Szetei ALSA: seq: close a re-opened queue timer in the destructor Nikita Maksimov ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 Johan Hovold media: vpif_capture: fix OF node reference imbalance Guangshuo Li media: vivid: fix cleanup bugs in vivid_init() Hans Verkuil media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil media: vivid: add vivid_update_reduced_fps() Guangshuo Li media: vimc: fix reference leak on failed device registration Guangshuo Li media: vidtv: fix reference leak on failed device registration Benjamin Gaignard media: verisilicon: Export only needed pixels formats Zile Xiong media: vb2: use ssize_t for vb2_read/vb2_write Sakari Ailus media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely Mirela Rabulea media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Pengpeng Hou media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Niklas Söderlund media: uapi: rkisp: Correct name version enum Myeonghun Pak media: ti: vpe: unwind v4l2 device registration on probe error Felix Gu media: ti: vpe: Fix the error code of devm_request_irq() Felix Gu media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice() Felix Gu media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete() Hungyu Lin media: tegra-video: vi: fix invalid u32 return value in format lookup Dmitry Osipenko media: synopsys: hdmirx: Fix HPD lane hold time Valery Borovsky media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak media: stm32: dcmi: unregister notifier on probe failure Valery Borovsky media: stm32-dcmipp: Return queued buffers on start_streaming() failure Ma Ke media: saa7134: Fix a possible memory leak in saa7134_video_init1 Jacopo Mondi media: rzv2h-ivc: Wait for frame end in stop_streaming Tommaso Merciai media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used Valery Borovsky media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak media: radio-si476x: Unregister v4l2_device on probe failure Bryan O'Donoghue media: qcom: camss: Fix RDI streaming for CSID 340 Bryan O'Donoghue media: qcom: camss: Fix RDI streaming for CSID GEN3 Bryan O'Donoghue media: qcom: camss: Fix RDI streaming for CSID GEN2 Bryan O'Donoghue media: qcom: camss: Fix RDI streaming for CSID 680 Valery Borovsky media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski media: pci: dm1105: Free allocated workqueue Guoniu Zhou media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe David Carlier media: nuvoton: npcm-video: fix memory leaks in probe and remove David Carlier media: nuvoton: npcm-video: fix error handling in npcm_video_init() Valery Borovsky media: msi2500: Return queued buffers on start_streaming() failure Anand Moon media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li media: marvell-cam: fix missing pci_disable_device() on remove David Carlier media: mali-c55: Power-off the peripheral in remove() Alper Ak media: mali-c55: Fix possible ERR_PTR in enable_streams David Carlier media: mali-c55: Disable pm_runtime on probe error David Carlier media: mali-c55: Add missing of_reserved_mem_device_release() Dmitry Baryshkov media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ Marco Nenciarini media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges Sakari Ailus media: imx219: Fix maximum frame length in lines Martin Hecht media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Sakari Ailus media: dw9719: Add back the I²C device id table Wang Jun <1742789905@qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold media: cx231xx: fix devres lifetime Brandon Brnich media: chips-media: wave5: Move src_buf Removal to finish_encode Pengpeng Hou media: cedrus: skip invalid H.264 reference list entries Samuel Holland media: cedrus: Fix missing cleanup in error path Myeonghun Pak media: cedrus: clean up media device on probe failure Myeonghun Pak media: cec: seco: unregister adapter on IR probe failure David Carlier media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Ricardo Ribalda media: amlogic-c3: Add validations for ae and awb config Valery Borovsky media: airspy: Return queued buffers on start_streaming() failure Maíra Canal drm/v3d: Reach the GMP through the hub registers on V3D 7.x Matthew Brost drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict Stanislav Kinsburskii drm/gpusvm: Zero HMM PFNs before scanning ranges Matthew Brost drm/ttm/pool: back up at native page order Matthew Brost drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION Linmao Li drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes drm/vmwgfx: Validate vmw_surface_metadata::array_size Matthew Brost drm/pagemap: Clear driver-provided PFNs from migration PFN array Leo Li drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() Linmao Li drm/vc4: Shut down BO cache timer before teardown Leo Li drm/amd/display: Fix flip-done timeouts on mode1 reset Alex Deucher drm/amdgpu: always emit the job vm fence Timur Kristóf drm/amdgpu: Print vmid, pasid and more task info in devcoredump Zhu Lingshan drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Mario Limonciello drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge Mario Limonciello drm/amd/display: Fix backlight max_brightness to match exported range Alessandro Rinaldi drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 Andriy Korud drm/amd/display: dce100: skip non-DP stream encoders for DP MST Leo Li drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock WenTao Liang drm/amd/display: set new_stream to NULL after release Timur Kristóf drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello drm/amd: Create a device link between APU display and XHCI devices Jesse Zhang drm/amdgpu/userq: fix indefinite fence wait during GPU reset Mario Limonciello drm/amdgpu: Fix VFCT bus number matching with soft filter Mario Limonciello drm/amdgpu: Release VFCT ACPI table reference Osama Abdelkader drm/panthor: return error on truncated firmware Matthew Brost drm/ttm: Account for NULL and handle pages in ttm_pool_backup Honglei Huang drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Jason Macnak drm/virtio: Don't detach GEM from a non-created context Alex Deucher drm/gfx10: Program DB_RING_CONTROL Yang Wang drm/amd/pm: fix smu14 power limit range calculation Jani Nikula drm/i915/mst: limit DP MST ESI service loop Joonas Lahtinen drm/i915/gt: Fix NULL deref on sched_engine alloc failure Joonas Lahtinen drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen drm/i915/gem: Do not leak siblings[] on proto context error Jesse Zhang drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue Shahyan Soltani drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() Kenneth Feng drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled Alex Deucher drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Jakob Linke drm/amdgpu/soc24: reset dGPU if suspend got aborted Jani Nikula drm/i915/bios: range check LFP Data Block panel_type2 Joonas Lahtinen drm/i915: Return NULL on error in active_instance Alex Deucher drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Alex Deucher drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() Prike Liang drm/amdgpu: add the doorbell index input for suspending userq Jani Nikula drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula drm/i915/hdcp: require monotonically increasing seq_num_v Jani Nikula drm/i915/vrr: require valid min/max vfreq for VRR Bryam Vargas drm/virtio: bound EDID block reads to the response buffer Leo Li Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs" WenTao Liang drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Honglei Huang drm/amd/display: use kvzalloc to allocate struct dc Thomas Zimmermann drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips Leorize drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x Guangshuo Li drm/amdkfd: free MQD managers on DQM init failures Yongqiang Sun drm/amdkfd: fix 32-bit overflow in CWSR total size calculation David Francis drm/amdkfd: Check bounds on CRIU restore queue type and mqd size David Francis drm/amdkfd: Check bounds in allocate_event_notification_slot David Francis drm/amdkfd: Use kvcalloc to allocate arrays Xiaogang Chen drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size Yongqiang Sun drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size Icenowy Zheng drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM Luigi Santivetti drm/imagination: fix error checking of pvr_vm_context_lookup() Shuvam Pandey drm/imagination: Fix user array stride in pvr_set_uobj_array() Brajesh Gupta drm/imagination: Fix double call to drm_sched_entity_fini() Arvind Yadav drm/xe/madvise: Skip invalidation for purgeable state updates Alexander Usyskin drm/xe/nvm: fix writable override for CRI Zongyao Bai drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Himal Prasad Ghimiray drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC Nitin Gote drm/xe: Hold a dma-buf reference for imported BOs Matthew Brost drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds Ashutosh Dixit drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Ashutosh Dixit drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG Matthew Brost drm/xe: Return error on non-migratable faults requiring devmem Matthew Auld drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs Pavel Ondračka drm/radeon: fix r100_copy_blit for large BOs Wentao Liang drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Imre Deak drm/i915/mtl+: Enable PPS before PLL Joonas Lahtinen drm/i915/gem: Add missing nospec on parallel submit slot Jani Nikula drm/displayid: fix Tiled Display Topology ID size Gerhard Schwanzer drm/amdkfd: Use exclusive bounds for SVM split alignment checks Timur Kristóf drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann drm/sysfb: Return errno code from drm_sysfb_get_visible_size() Thomas Zimmermann drm/sysfb: Avoid possible truncation with calculating visible size Junrui Luo drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Tvrtko Ursulin drm/amdgpu: Fix context pstate override handling Timur Kristóf drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Jiqian Chen drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 Ivan Lipski drm/amd/display: Restore periodic detection for DCN35 Brian Nguyen drm/xe: Add compact-PT and addr mask handling for page reclaim Tejas Upadhyay drm/xe/guc: Fix buffer overflow in steered register list allocation Thomas Zimmermann drm/sysfb: Avoid truncating maximum stride Thomas Zimmermann drm/sysfb: Do not page-align visible size of the framebuffer Mario Limonciello drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO Timur Kristóf drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Asad Kamal drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Shubhankar Milind Sardeshpande drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs Ville Syrjälä drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable Ashutosh Desai drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Alessio Belle drm/imagination: Fit paired fragment job in the correct CCCB Thomas Zimmermann drm/tegra: fbdev: Remove offset into framebuffer memory Ashutosh Desai drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Thomas Zimmermann drm/exynos: fbdev: Remove offset into screen_buffer Vitor Soares drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Alessio Belle drm/imagination: Count paired job fence as dependency in prepare_job() Chen Ni drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() Sergey Shtylyov drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Tomi Valkeinen drm/tidss: Fix missing drm_bridge_add() call Biju Das drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() Biju Das drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay David Carlier tracing: Fix use-after-free freeing trigger private data Chengfeng Ye bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Pu Lehui LoongArch: BPF: Fix memory leak in bpf_jit_free() Mateusz Guzik pidfs: make pidfs_ino_lock static Eric Dumazet drop_monitor: perform u64_stats updates under IRQ-disabled section Eric Dumazet drop_monitor: fix size calculations for 64-bit attributes Yehyeong Lee net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD Vikas Gupta bnge/bng_re: fix ring ID widths Cen Zhang (Microsoft) tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() Lorenzo Bianconi net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() Minhong He mctp: check register_netdevice_notifier() error in mctp_device_init() Clark Wang ptp: netc: explicitly clear TMR_OFF during initialization Cen Zhang (Microsoft) rds: tcp: unregister sysctl before tearing down listen socket Nikola Z. Ivanov ipv6: Change allocation flags to match rcu_read_lock section requirements Emil Tantilov idpf: fix max_vport related crash on allocation error during init Paul Greenwalt ice: prevent tstamp ring allocation for non-PF VSI types Marcin Szycik

[PATCH 7.1 001/744] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug

LLM 分析