[SRU][Noble][PULL] Noble upstream stable patchset 2025-10-29
Manuel Diewald
manuel.diewald at canonical.com
Wed Oct 29 19:32:40 UTC 2025
This pull request (130 commits) includes the following Noble stable patchsets:
Noble update: upstream stable patchset 2025-10-29
Ported from the following upstream stable releases:
v6.6.91, v6.12.29
https://bugs.launchpad.net/bugs/2130277
Note also that the 'stable-next' branch head contains this and all
prior pending upstream stable releases. I recommend fetching and
applying just this reference ('stable-next') instead of each
tags/noble-stable-* reference:
git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble stable-next
-Manuel
------------------------------------------------------------------------
The following changes since commit 519321bba0a5bbc311e9836f6c2e09efc87a4bb7:
UBUNTU: Upstream stable to v6.6.90, v6.12.27, v6.12.28 (2025-10-22 16:35:40 +0200)
are available in the Git repository at:
git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble tags/noble-stable-2025-10-29
for you to fetch changes up to 4993cf39ac72cb319eb32c9b53eaa51dadbc0c08:
UBUNTU: Upstream stable to v6.6.91, v6.12.29 (2025-10-29 20:23:56 +0100)
----------------------------------------------------------------
Aditya Garg (3):
Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
Input: synaptics - enable InterTouch on Dell Precision M3800
Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
Al Viro (1):
do_umount(): add missing barrier before refcount checks in sync case
Alexander Lobakin (1):
netdevice: add netdev_tx_reset_subqueue() shorthand
Alexey Charkov (1):
usb: uhci-platform: Make the clock really optional
Andrei Kuchynski (1):
usb: typec: ucsi: displayport: Fix NULL pointer access
Andy Shevchenko (1):
types: Complement the aligned types with signed 64-bit one
Angelo Dureghello (1):
iio: adc: ad7606: fix serial register access
Borislav Petkov (AMD) (1):
x86/microcode: Consolidate the loader enablement checking
Clément Léger (2):
riscv: misaligned: factorize trap handling
riscv: misaligned: enable IRQs while handling misaligned accesses
Cong Wang (1):
sch_htb: make htb_deactivate() idempotent
Cristian Marussi (1):
firmware: arm_scmi: Fix timeout checks on polling path
Dan Carpenter (1):
dm: add missing unlock on in dm_keyslot_evict()
Daniel Golle (1):
net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
Daniel Sneddon (2):
x86/bpf: Call branch history clearing sequence on exit
x86/bpf: Add IBHF call at end of classic BPF
Dave Penkler (3):
usb: usbtmc: Fix erroneous get_stb ioctl error returns
usb: usbtmc: Fix erroneous wait_srq ioctl return
usb: usbtmc: Fix erroneous generic_read ioctl return
David Lechner (1):
iio: imu: inv_mpu6050: align buffer for timestamp
Dmitry Antipov (1):
module: ensure that kobject_put() is safe for module type kobjects
Dmitry Torokhov (1):
Input: synaptics - enable SMBus for HP Elitebook 850 G1
Eelco Chaudron (1):
openvswitch: Fix unsafe attribute parsing in output_userspace()
Eric Biggers (1):
x86/its: Fix build errors when CONFIG_MODULES=n
Feng Tang (1):
selftests/mm: compaction_test: support platform with huge mount of memory
Gabriel Shahrouzi (4):
staging: iio: adc: ad7816: Correct conditional logic for store mode
staging: axis-fifo: Remove hardware resets for user errors
staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
iio: adis16201: Correct inclinometer channel resolution
Gao Xiang (1):
erofs: ensure the extra temporary copy is valid for shortened bvecs
Gary Bisson (1):
Input: mtk-pmic-keys - fix possible null pointer dereference
Gavin Guo (1):
mm/huge_memory: fix dereferencing invalid pmd migration entry
Guillaume Nault (1):
gre: Fix again IPv6 link-local address generation.
Heiko Carstens (1):
s390/entry: Fix last breaking event handling in case of stack corruption
Hugo Villeneuve (1):
Input: cyttsp5 - ensure minimum reset pulse width
James Morse (6):
arm64: insn: Add support for encoding DSB
arm64: proton-pack: Expose whether the platform is mitigated by firmware
arm64: proton-pack: Expose whether the branchy loop k value
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
Jan Kara (3):
ocfs2: switch osb->disable_recovery to enum
ocfs2: implement handshaking with ocfs2 recovery thread
ocfs2: stop quota recovery before disabling quotas
Jason Andryuk (1):
xenbus: Use kref to track req lifetime
Jens Axboe (2):
io_uring: always arm linked timeouts prior to issue
io_uring: ensure deferred completions are flushed for multishot
Jim Lin (1):
usb: host: tegra: Prevent host controller crash when OTG port is used
John Ernberg (1):
xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
Jonas Gorski (11):
net: dsa: b53: allow leaky reserved multicast
net: dsa: b53: fix clearing PVID of a port
net: dsa: b53: fix flushing old pvid VLAN on pvid change
net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
net: dsa: b53: always rejoin default untagged VLAN on bridge leave
net: dsa: b53: fix learning on VLAN unaware bridges
net: dsa: b53: keep CPU port always tagged again
net: dsa: b53: do not allow to configure VLAN 0
net: dsa: b53: do not program vlans when vlan filtering is off
net: dsa: b53: fix toggling vlan_filtering
net: dsa: b53: do not set learning and unicast/multicast on up
Jonathan Cameron (3):
iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
iio: adc: dln2: Use aligned_s64 for timestamp
Julian Anastasov (1):
ipvs: fix uninit-value for saddr in do_output_route4
Kelsey Maes (1):
can: mcp251xfd: fix TDC setting for low data bit rates
Kevin Baker (1):
drm/panel: simple: Update timings for AUO G101EVN010
Lode Willems (1):
Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
Lothar Rubusch (1):
iio: accel: adxl367: fix setting odr for activity time update
Manuel Diewald (3):
UBUNTU: SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
UBUNTU: [Config] enable Indirect Target Selection mitigation
UBUNTU: Upstream stable to v6.6.91, v6.12.29
Manuel Fombuena (1):
Input: synaptics - enable InterTouch on Dynabook Portege X30-D
Marc Kleine-Budde (2):
can: mcan: m_can_class_unregister(): fix order of unregistration calls
can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
Matthew Brost (1):
drm/xe: Add page queue multiplier
Maíra Canal (1):
drm/v3d: Add job to pending list if the reset was skipped
Miguel Ojeda (1):
rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration
Mikael Gonella-Bolduc (1):
Input: cyttsp5 - fix power control issue on wakeup
Mikhail Lobanov (1):
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
Namjae Jeon (1):
ksmbd: prevent rename with empty string
Norbert Szetei (1):
ksmbd: prevent out-of-bounds stream writes by validating *pos
Nylon Chen (1):
riscv: misaligned: Add handling for ZCB instructions
Nysal Jan K.A (1):
selftests/mm: fix a build failure on powerpc
Oliver Hartkopp (1):
can: gw: fix RCU/BH usage in cgw_create_job()
Oliver Neukum (1):
USB: usbtmc: use interruptible sleep in usbtmc_read
Paul Aurich (1):
smb: client: Avoid race in open_cached_dir with lease breaks
Paul Chaignon (1):
bpf: Scrub packet on bpf_redirect_peer
Pawan Gupta (15):
x86/bhi: Do not set BHI_DIS_S in 32-bit mode
x86/speculation: Simplify and make CALL_NOSPEC consistent
x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
Documentation: x86/bugs/its: Add ITS documentation
x86/its: Enumerate Indirect Target Selection (ITS) bug
x86/its: Add support for ITS-safe indirect thunk
x86/its: Add support for ITS-safe return thunk
x86/its: Enable Indirect Target Selection mitigation
x86/its: Add "vmexit" option to skip mitigation on some CPUs
x86/its: Add support for RSB stuffing mitigation
x86/its: Align RETs in BHB clear sequence to avoid thunking
x86/ibt: Keep IBT disabled during alternative patching
x86/its: Fix build error for its_static_thunk()
selftest/x86/bugs: Add selftests for ITS
Pawel Laszczak (2):
usb: cdnsp: Fix issue with resuming from L1
usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
Peter Xu (1):
mm/userfaultfd: fix uninitialized output field for -EAGAIN race
Peter Zijlstra (2):
x86/its: Use dynamic thunks for indirect branches
x86/its: FineIBT-paranoid vs ITS
Prashanth K (3):
usb: gadget: f_ecm: Add get_status callback
usb: gadget: Use get_status callback to set remote wakeup capability
usb: dwc3: gadget: Make gadget_wakeup asynchronous
RD Babiera (1):
usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
Sean Heelan (1):
ksmbd: Fix UAF in __close_file_table_ids
Sebastian Andrzej Siewior (1):
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
Silvano Seva (2):
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
Simon Xue (1):
iio: adc: rockchip: Fix clock initialization sequence
Thorsten Blum (1):
MIPS: Fix MAX_REG_OFFSET
Tom Lendacky (1):
memblock: Accept allocated memory before use in memblock_double_array()
Veerendranath Jakkam (1):
wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
Vicki Pfau (1):
Input: xpad - fix Share button on Xbox One controllers
Wang Zhaolong (1):
ksmbd: fix memory leak in parse_lease_state()
Wayne Chang (1):
usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
Wayne Lin (5):
drm/amd/display: Shift DMUB AUX reply command if necessary
drm/amd/display: Fix the checking condition in dmub aux handling
drm/amd/display: Remove incorrect checking in dmub aux handler
drm/amd/display: Fix wrong handling for AUX_DEFER case
drm/amd/display: Copy AUX read reply data whenever length > 0
Wojciech Dubowik (1):
arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
.clippy.toml | 2 +-
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 +
Documentation/admin-guide/hw-vuln/index.rst | 1 +
.../hw-vuln/indirect-target-selection.rst | 168 ++++++++++++++++
Documentation/admin-guide/kernel-parameters.txt | 18 ++
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 25 ++-
arch/arm64/include/asm/cputype.h | 2 +
arch/arm64/include/asm/insn.h | 1 +
arch/arm64/include/asm/spectre.h | 3 +
arch/arm64/kernel/proton-pack.c | 13 +-
arch/arm64/lib/insn.c | 60 +++---
arch/arm64/net/bpf_jit_comp.c | 57 +++++-
arch/mips/include/asm/ptrace.h | 3 +-
arch/riscv/kernel/traps.c | 64 +++---
arch/riscv/kernel/traps_misaligned.c | 17 ++
arch/s390/kernel/entry.S | 2 +-
arch/x86/Kconfig | 11 ++
arch/x86/entry/entry_64.S | 20 +-
arch/x86/include/asm/alternative.h | 32 +++
arch/x86/include/asm/cpufeatures.h | 3 +
arch/x86/include/asm/microcode.h | 2 +
arch/x86/include/asm/msr-index.h | 8 +
arch/x86/include/asm/nospec-branch.h | 38 ++--
arch/x86/kernel/alternative.c | 216 ++++++++++++++++++++-
arch/x86/kernel/cpu/bugs.c | 177 ++++++++++++++++-
arch/x86/kernel/cpu/common.c | 72 +++++--
arch/x86/kernel/cpu/microcode/amd.c | 6 +-
arch/x86/kernel/cpu/microcode/core.c | 58 +++---
arch/x86/kernel/cpu/microcode/intel.c | 2 +-
arch/x86/kernel/cpu/microcode/internal.h | 1 -
arch/x86/kernel/ftrace.c | 2 +-
arch/x86/kernel/head32.c | 4 -
arch/x86/kernel/module.c | 6 +
arch/x86/kernel/static_call.c | 4 +-
arch/x86/kernel/vmlinux.lds.S | 10 +
arch/x86/kvm/smm.c | 1 +
arch/x86/kvm/svm/svm.c | 4 +
arch/x86/kvm/x86.c | 4 +-
arch/x86/lib/retpoline.S | 39 ++++
arch/x86/net/bpf_jit_comp.c | 59 +++++-
debian.master/config/annotations | 1 +
debian.master/upstream-stable | 4 +-
drivers/base/cpu.c | 3 +
drivers/clocksource/i8253.c | 4 +-
drivers/firmware/arm_scmi/driver.c | 16 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +-
.../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 28 ++-
drivers/gpu/drm/panel/panel-simple.c | 25 +--
drivers/gpu/drm/v3d/v3d_sched.c | 28 ++-
drivers/gpu/drm/xe/xe_gt_pagefault.c | 11 +-
drivers/iio/accel/adis16201.c | 4 +-
drivers/iio/accel/adxl355_core.c | 2 +-
drivers/iio/accel/adxl367.c | 10 +-
drivers/iio/adc/ad7606_spi.c | 2 +-
drivers/iio/adc/dln2-adc.c | 2 +-
drivers/iio/adc/rockchip_saradc.c | 17 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 6 +
drivers/iio/temperature/maxim_thermocouple.c | 2 +-
drivers/input/joystick/xpad.c | 36 ++--
drivers/input/keyboard/mtk-pmic-keys.c | 4 +-
drivers/input/mouse/synaptics.c | 5 +
drivers/input/touchscreen/cyttsp5.c | 7 +-
drivers/md/dm-table.c | 3 +-
drivers/net/can/m_can/m_can.c | 2 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 42 +++-
drivers/net/dsa/b53/b53_common.c | 202 +++++++++++++------
drivers/net/dsa/b53/b53_priv.h | 3 +
drivers/net/dsa/bcm_sf2.c | 1 +
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 +-
drivers/staging/axis-fifo/axis-fifo.c | 14 +-
drivers/staging/iio/adc/ad7816.c | 2 +-
drivers/usb/cdns3/cdnsp-gadget.c | 31 +++
drivers/usb/cdns3/cdnsp-gadget.h | 6 +
drivers/usb/cdns3/cdnsp-pci.c | 12 +-
drivers/usb/cdns3/cdnsp-ring.c | 3 +-
drivers/usb/cdns3/core.h | 3 +
drivers/usb/class/usbtmc.c | 59 +++---
drivers/usb/dwc3/core.h | 4 +
drivers/usb/dwc3/gadget.c | 60 +++---
drivers/usb/gadget/composite.c | 12 +-
drivers/usb/gadget/function/f_ecm.c | 7 +
drivers/usb/gadget/udc/tegra-xudc.c | 4 +
drivers/usb/host/uhci-platform.c | 2 +-
drivers/usb/host/xhci-tegra.c | 3 +
drivers/usb/typec/tcpm/tcpm.c | 2 +-
drivers/usb/typec/ucsi/displayport.c | 2 +
drivers/xen/swiotlb-xen.c | 1 +
drivers/xen/xenbus/xenbus.h | 2 +
drivers/xen/xenbus/xenbus_comms.c | 9 +-
drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +-
drivers/xen/xenbus/xenbus_xs.c | 18 +-
fs/erofs/zdata.c | 31 ++-
fs/namespace.c | 3 +-
fs/ocfs2/journal.c | 80 +++++---
fs/ocfs2/journal.h | 1 +
fs/ocfs2/ocfs2.h | 17 +-
fs/ocfs2/quota_local.c | 9 +-
fs/ocfs2/super.c | 3 +
fs/smb/client/cached_dir.c | 10 +-
fs/smb/server/oplock.c | 7 +-
fs/smb/server/smb2pdu.c | 5 +
fs/smb/server/vfs.c | 7 +
fs/smb/server/vfs_cache.c | 33 +++-
fs/userfaultfd.c | 28 ++-
include/linux/cpu.h | 2 +
include/linux/module.h | 5 +
include/linux/netdevice.h | 13 +-
include/linux/types.h | 3 +-
include/uapi/linux/types.h | 1 +
io_uring/io_uring.c | 58 +++---
kernel/params.c | 4 +-
mm/huge_memory.c | 11 +-
mm/memblock.c | 9 +-
net/can/gw.c | 149 ++++++++------
net/core/filter.c | 1 +
net/ipv6/addrconf.c | 15 +-
net/netfilter/ipvs/ip_vs_xmit.c | 27 +--
net/openvswitch/actions.c | 3 +-
net/sched/sch_htb.c | 2 -
net/wireless/scan.c | 2 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/mm/compaction_test.c | 19 +-
tools/testing/selftests/mm/pkey-powerpc.h | 12 +-
tools/testing/selftests/x86/bugs/Makefile | 3 +
tools/testing/selftests/x86/bugs/common.py | 164 ++++++++++++++++
.../selftests/x86/bugs/its_indirect_alignment.py | 150 ++++++++++++++
.../testing/selftests/x86/bugs/its_permutations.py | 109 +++++++++++
.../selftests/x86/bugs/its_ret_alignment.py | 139 +++++++++++++
tools/testing/selftests/x86/bugs/its_sysfs.py | 65 +++++++
130 files changed, 2573 insertions(+), 610 deletions(-)
create mode 100644 Documentation/admin-guide/hw-vuln/indirect-target-selection.rst
create mode 100644 tools/testing/selftests/x86/bugs/Makefile
create mode 100644 tools/testing/selftests/x86/bugs/common.py
create mode 100644 tools/testing/selftests/x86/bugs/its_indirect_alignment.py
create mode 100644 tools/testing/selftests/x86/bugs/its_permutations.py
create mode 100644 tools/testing/selftests/x86/bugs/its_ret_alignment.py
create mode 100644 tools/testing/selftests/x86/bugs/its_sysfs.py
More information about the kernel-team
mailing list