Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v7.1-rc6 2026-05-31T18:50:39+00:00 2026-05-31T18:50:39+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-31T18:50:39+00:00 urn:sha1:8d9c51eac648ec953ea534b536d62337be3744b7 Pull media fixes from Mauro Carvalho Chehab: - rc: igorplugusb: fix control request setup packet - vsp1: revert a couple patches to fix regressions when setting DRM pipelines * tag 'media/v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: rc: igorplugusb: fix control request setup packet Revert "media: renesas: vsp1: brx: Fix format propagation" Revert "media: renesas: vsp1: Initialize format on all pads" 2026-05-31T15:45:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-31T15:45:08+00:00 urn:sha1:13bd441bb98e9cc91f9fb4449415e0519a0de7a9 Pull SCSI fixes from James Bottomley: "Two core changes, the only one of significance being the change to kick queues in SDEV_CANCEL which had a small window for stuck requests. The major driver fixes are the one to the FC transport class to widen the FPIN counter to counter a theoretical (and privileged) fabric traffic injection attack and the other is an iscsi fix where a malicious target could trick the kernel into an output buffer overrun. Both the driver fixes were AI assisted" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: iscsi: Validate CHAP_R length before base64 decode scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues 2026-05-31T15:33:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-31T15:33:08+00:00 urn:sha1:9cf1afe6de1dc9dfced6070328626830794bac9d Pull i2c fixes from Wolfram Sang: - davinci: fix fallback bus frequency on missing clock-frequency - virtio: mark device ready initially * tag 'i2c-for-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: virtio: mark device ready before registering the adapter i2c: davinci: fix division by zero on missing clock-frequency 2026-05-31T15:27:18+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-31T15:27:18+00:00 urn:sha1:227abb780c68687d6800cf9eafaff0cbeca4bf45 Pull input fixes from Dmitry Torokhov: - updates to Elan I2C touchpad driver to handle a new IC type and to validate size of supplied firmware to prevent OOB access - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a potential OOB access when handling "Share" button - an update to Synaptics touchpad driver to use RMI mode for touchpad in Thinkpad E490 - updates to Atmel MXT driver adding checks to prevent potential OOB accesses - a fix to IMS PCU driver to free correct amount of memory when tearing it down - a fixup to the recent change to Atlas buttons driver - a small cleanup in fm801-fp for PCI IDs table initialisation * tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atlas - check ACPI_COMPANION() against NULL Input: atmel_mxt_ts - check mem_size before calculating config memory size Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Input: fm801-gp - simplify initialisation of pci_device_id array Input: xpad - add "Nova 2 Lite" from GameSir Input: xpad - add support for ASUS ROG RAIKIRI II Input: elan_i2c - validate firmware size before use Input: xpad - fix out-of-bounds access for Share button Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size Input: elan_i2c - increase device reset wait timeout after update FW Input: elan_i2c - add ic type 0x19 2026-05-30T16:21:47+00:00 Henri A contact@henrialfonso.com 2026-05-20T14:25:44+00:00 urn:sha1:171022c7d594c133a45f92357a2a91475edabe20 Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet. Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules") Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51 Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5.5 Signed-off-by: Henri A <contact@henrialfonso.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> 2026-05-30T15:37:45+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T15:37:45+00:00 urn:sha1:670b77dfebe7257adc0defbc48a4c43cfdf6c8f6 Pull USB and Thunderbolt fixes from Greg KH: "Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing major in here, just lots of tiny fixes for reported issues found by users and some older patches found by some scanning tools. Included in here are: - typec fixes found by fuzzers that have decided to finally look at that device interaction path (i.e. before a driver is bound to a device) - typec fixes for issues found by users - thunderbolt driver fixes for reported problems - cdns3 driver fixes - dwc3 driver fixes - new device quirks added - usb serial driver fixes for broken devices - other small driver fixes All of these have been in linux-next for over a week with no reported issues" * tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits) USB: serial: cypress_m8: validate interrupt packet headers USB: serial: safe_serial: fix memory corruption with small endpoint USB: serial: omninet: fix memory corruption with small endpoint USB: serial: mxuport: fix memory corruption with small endpoint USB: serial: cypress_m8: fix memory corruption with small endpoint USB: cdc-acm: Fix bit overlap and move quirk definitions to header usb: dwc2: Fix use after free in debug code usb: chipidea: core: convert ci_role_switch to local variable usb: gadget: f_fs: serialize DMABUF cancel against request completion usb: gadget: f_fs: copy only received bytes on short ep0 read usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports dt-bindings: usb: Fix EIC7700 USB reset's issue usbip: vudc: Fix use after free bug in vudc_remove due to race condition dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints usb: storage: Add quirks for PNY Elite Portable SSD USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize usb: usbtmc: check URB actual_length for interrupt-IN notifications xhci: tegra: Fix ghost USB device on dual-role port unplug usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind ... 2026-05-30T15:34:03+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T15:34:03+00:00 urn:sha1:495fb8dd7f1da991c5325f4a0a50d0b042f19523 Pull tty/serial driver fixes from Greg KH: "Here are some small serial driver fixes for 7.1-rc6. Included in here are: - mips serial driver fixes to resolve some long-standing issues with how they interacted with the console. That's the "majority" of the changes in this merge request - sh-sci driver regression fix - 8250 driver regression fixes - other small serial driver fixes for reported problems. All of these have been in linux-next for over a week with no reported issues" * tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: dz: Enable modular build serial: zs: Convert to use a platform device serial: dz: Convert to use a platform device serial: zs: Switch to using channel reset serial: zs: Fix bootconsole handover lockup serial: dz: Fix bootconsole handover lockup serial: dz: Fix bootconsole message clobbering at chip reset serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() serial: 8250: dispatch SysRq character in serial8250_handle_irq() serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) tty: serial: samsung: Remove redundant port lock acquisition in rx helpers serial: altera_jtaguart: handle uart_add_one_port() failures serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma tty: add missing tty_driver include to tty_port.h serial: qcom-geni: fix UART_RX_PAR_EN bit position serial: sh-sci: fix memory region release in error path tty: serial: pch_uart: add check for dma_alloc_coherent() serial: zs: Fix swapped RI/DSR modem line transition counting 2026-05-30T15:30:12+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T15:30:12+00:00 urn:sha1:25447851777a53bd4b501e7f2cb418332ad584cc Pull char/misc/iio fixes from Greg KH: "Here are some small char/misc/iio driver fixes for 7.1-rc6. Included in here are: - lots of small IIO driver fixes for reported problems. - Android binder bugfixes for reported issues. - small comedi test driver fixes - counter driver fix - parport driver fix (people still use this?) - rpi driver fix - uio driver fix All of these have been in linux-next for over a week with no reported problems" * tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits) Revert "gpib: cb7210: Fix region leak when request_irq fails" misc: rp1: Send IACK on IRQ activate to fix kdump/kexec gpib: cb7210: Fix region leak when request_irq fails parport: Fix race between port and client registration uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory rust_binder: Avoid holding lock when dropping delivered_death rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw iio: gyro: itg3200: fix i2c read into the wrong stack location iio: dac: ad5686: fix powerdown control on dual-channel devices iio: dac: ad5686: acquire lock when doing powerdown control iio: temperature: tsys01: fix broken PROM checksum validation iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings iio: buffer: hw-consumer: fix use-after-free in error path iio: dac: ad5686: fix input raw value check iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: ssp_sensors: cancel delayed work_refresh on remove iio: adc: meson-saradc: fix calibration buffer leak on error ... 2026-05-30T13:56:07+00:00 Alexis Bouzigues BouziguesAlexis@JohnDeere.com 2026-05-29T14:28:14+00:00 urn:sha1:1d774589f924056b8403e271fdecaf9a803a50fc virtio_i2c_probe() synchronously probes child i2c drivers on the bus, but peripherals may use the bus at probe for tasks like reading a chip id. The vhost-user-i2c backend stalls at such probes unless DRIVER_OK is already set before the virtqueue is first kicked. Set DRIVER_OK explicitly before i2c_add_adapter(), as done for the same reason in commit f5866db64f34 ("virtio_console: enable VQs early") and commit 71e4b8bf0482 ("virtio_rpmsg: set DRIVER_OK before using device"). Signed-off-by: Alexis Bouzigues <BouziguesAlexis@JohnDeere.com> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> 2026-05-30T10:25:36+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-05-30T10:25:36+00:00 urn:sha1:05d5d79440c2cc0784f91b61f2012753e66be472 This reverts commit 2eae90a457baa0048a96ed38ad93090ee38c8b2f. Turns out not to be correct. Link: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg=@protonmail.com Reported-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com> Cc: Mark Brown <broonie@kernel.org> Cc: Hongling Zeng <zhongling0719@126.com> Cc: Hongling Zeng <zenghongling@kylinos.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>