Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
  resolve some reported issues. Included in here are:

   - new quirk for some broken USB devices

   - thunderbolt device fixes for reported issues

   - usb gadget driver fix

   - usb atm driver fix

   - xhci driver fixes.

   - other minor USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
  usb: quirks: Add ShanWan gamepad to quirk list
  usb: hub: Split announce_device() to log device identity before enumeration
  usb: core: Add quirk for 255-bytes initial config read
  usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
  usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
  usb: gadget: f_ncm: Use unsigned int for ndp_index
  usb: cdnsp: fix incorrect endian conversions for APB timeout register
  thunderbolt: Initialize ->domain_released completion before it is being used
  thunderbolt: icm: Preserve USB4 proxy data-valid bit
  thunderbolt: Bound the DROM dual link port number before indexing sw->ports
  thunderbolt: Fix bandwidth group reservation indexing
  thunderbolt: stream: Unmap buffers with mapped size

Pull char / misc and documentation fixes from Greg KH:
 "Here are some small char/misc and nvmem and documentation fixes for
  7.2-rc7 to resolve some reported issues.  Included in here are:

   - updates to the documentation for the kernel threat model and
     security bugs to get the LLMs to actually follow what we have been
     asking them to do (i.e. not claim security issues for things we do
     not consider security issues.)

   - nvmem driver fixes which required a tiny "layout" driver to be
     added.

   - fastrpc driver fixes

   - mei driver fix

   - counter driver fix

   - binder driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  docs: security-bugs: clarify some mandatory steps for AI reports
  docs: coding-assistant: explain important steps when looking for bugs
  docs: security-bugs: clarify what counts as a valid version
  docs: threat-model: move fake devices out of "non production use"
  docs: threat-model: clarify "security bug" vs "vulnerability"
  counter: microchip-tcb-capture: Fix DT channel validation
  mei: pull kvfree out of spinlock
  rust_binder: do not query current thread for all ioctls
  nvmem: layouts: Add fixed-layout driver
  nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
  misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
  misc: fastrpc: fix channel ctx ref leak when session alloc fails
  misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
  misc: fastrpc: Remove buffer from list prior to unmap operation
  misc: fastrpc: Fix initial memory allocation for Audio PD memory pool

Pull driver core fixes from Danilo Krummrich:

 - Fix Rust build failure on s390 by gating ioremap() / iounmap()
   helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected
   doctests as well.

 - Add missing kernel-doc for show_const / store_const union members in
   struct device_attribute.

* tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM
  rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
  driver core: add missing kernel-doc for union members

Pull input updates from Dmitry Torokhov:

 - Fixes for information leaks and OOB accesses across several drivers,
   including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra

 - Improvements to the synaptics-rmi4 driver to properly handle F54
   worker errors and prevent buffer overflows

 - Input validation fixes in the hynitron_cstxxx touchscreen driver to
   prevent issues with invalid finger IDs and touch counts

 - Fixes for use-after-free and initialization bugs in the byd mouse and
   psxpad-spi drivers

 - New quirks for the atkbd driver to make keyboard work on HONOR and
   Xiaomi laptops

 - Support for the ZENAIM LEVERLESS controller in the xpad driver.

* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: evdev - sanitize event type index when fetching event masks
  Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
  Input: synaptics-rmi4 - block s_input when F54 queue is busy
  Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
  Input: synaptics-rmi4 - zero report size on F54 work error
  Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
  Input: hynitron_cstxxx - validate touch count and finger IDs
  Input: evdev - fix information leak in evdev_pass_values()
  fixp-arith: convert comments to kernel-doc format
  Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
  Input: atkbd - skip deactivate for HONOR ZQC-P
  Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
  Input: iforce - validate input packet lengths
  Input: psxpad-spi - set driver data before use
  Input: cs40l50-vibra - validate custom data from user space
  Input: xpad - add support for ZENAIM LEVERLESS
  Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
  Input: byd - synchronize timer deletion before freeing private data

Pull thermal control fixes from Rafael Wysocki:
 "Revert three thermal core updates, two recent ones and one older.

  The recent ones attempted to fix a design issue in the thermal core
  and simplify code on top of that, but they made changes visible to
  user space and made it unhappy.

  The older one is a misguided code cleanup that introduced a
  (potentially nasty) bug"

* tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
  Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
  Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes since the last pull request. More than
  few, but an enough-manageable amount at this time.

  USB-audio:
   - UAF, OOB and such hardening fixes for USB-audio, usx2y and
     us144mkii
   - Mixer regression fixes for Logitech PRO X 2 LIGHTSPEED headset and
     M-Audio Fast Track Ultra

  HD-audio:
   - Fix for an ACPI reference leak in TAS2781 HDA side-codec

  ASoC:
   - Fixes the default tables for Cirrus Logic codecs
   - Fixes for invalid enum accesses for Qualcomm LPASS
   - Error handling and robustness fixes for Intel SOF & Soundwire
   - DMI quirks for a few AMD devices"

* tag 'sound-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (22 commits)
  ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra
  ASoC: cs4265: sort the register default table
  ASoC: cs35l45: sort the register default table
  ASoC: cs35l41: sort the register default table
  ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG
  ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025
  ALSA: usx2y: bound the hwdep mmap fault offset
  ALSA: usb-audio: fix OOB write on Type II inbound URBs
  ALSA: us144mkii: re-anchor capture URBs on resubmission
  ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
  MAINTAINERS: add SpacemiT K1/K3 I2S entry
  ASoC: rt5645: Make the Kconfig symbol user selectable
  ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED
  ALSA: hda/tas2781: fix ACPI reference handling
  ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
  ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
  ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
  ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
  ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close
  ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
  ...

Pull MM fixes from Andrew Morton:
 "17 hotfixes.  15 are cc:stable.  16 are for MM.

  There's a patch series from Lorenzo "mm: fix UAF caused by race
  between ptdump and vmap pgtable freeing" which addresses a quite old
  bug in the ptdump code.

  And another series also from Lorenzo which fixes a four year old bug
  in the huge_zero_folio handling.

  A series from SJ fixes a few possible divide-by-zero issues which
  Sashiko sniffed out. And a series which fixes handling of the
  commit_inputs parameters.

  The remainder are singletons, please see their changelogs for details"

* tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
  mm/damon/ops-common: putback folios on invalid migrate nid
  mm/huge_memory: initialise workingset state before folio split
  mm/page_table_check: skip special zero mappings
  mm/damon/lru_sort: skip damon_call() if ctx has not started
  mm/damon/reclaim: skip damon_call() if ctx has not started
  mm/damon/lru_sort: error out for >10000 active_mem_bp
  samples/damon/mtier: error out for zero quota goal target values
  mailmap: map old addresses to Danila Tikhonov
  mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic
  mm/huge_memory: fix huge_zero_pfn race
  MAINTAINERS: update address for Brendan Jackman
  mm/filemap: __filemap_add_folio() restore index before retrying
  microblaze: restore the page alignment of swapper_pg_dir
  arm64: remove redundant concurrent ptdump UAF mitigation
  mm/ptdump: always stabilise against page table freeing using init_mm
  mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba:
 "This brings back the fixup worker infrastructure.

  It's a mechanism to detect pages/folios that are marked dirty without
  filesystem knowledge and require COW fixup. The consequence of not
  doing so is silent data loss.

  The first patch covers the scenarios in detail, also reflecting folio
  API port and subpage block size support added in recent years. The
  original fixup worker was only for pages.

  The patch is relatively big, half of the code is debugging and support
  code, the rest is the core design around the detection and fix.

  The second patch handles an unlikely case when there's work left
  during unmount"

* tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: flush the fixup workers during close_ctree
  btrfs: trigger cow fixup via dirty_folio()

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter.

  Looks like our attempt to keep the PRs smaller have only prevented
  this one from getting even bigger. In the last 9 days there were
  405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
  net-next]. 37% of posted patches being fixes is pretty crazy, and
  that's likely undercounting because LLM "researchers" more often post
  fixes without knowing to tag the patches for specific trees. I don't
  have historic data.

  In any case, we keep adjusting the criteria. The next PR will be
  smaller.

  Current release - regressions:

   - net: defer netdev KOBJ_ADD uevent until the device is published,
     previously rtnl_lock would serialize the accesses vs publishing

   - net: explicitly cancel work to avoid races with ref tracker exit

   - qrtr: ns: raise lookup limit to 128

   - eth: hns3: fix speed configuration residue after driver reload

  Previous releases - regressions:

   - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed
     flows with MSS and scaling_ratio variability

   - Revert "net: thunderbolt: Enable end-to-end flow control also in
     transmit", broke some platforms (no packets coming thru)

   - eth: stmmac: resume PHY before hardware setup when opening the
     interface

  Previous releases - always broken:

   - another pile of fixes for less common protocols (SCTP, TLS, SMC
     etc.)

   - close a couple of AF_PACKET bugs and ways it can build skbs
     problematic for the rest of the stack

   - bridge: mrp: fix uninitialised bytes on the wire

   - net: devmem: prevent net-iov / page mixing, avoid crashes

   - eth: atlantic: free RX pages of consumed but not refilled buffers"

* tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits)
  igc: fix netdev not re-attached after resume if interface is down
  tls: don't abort the connection on signal-interrupted sends
  net: avoid theoretical races with ref drain
  net: Defer netdev KOBJ_ADD uevent until the device is published
  MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
  sctp: clear control chunk transport if it is being removed
  net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
  s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
  packet: use consistent hard_header_len in TX_RING send path
  packet: use consistent hard_header_len in non-ring send paths
  net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
  bnge: Fix resource leak in bnge_init_nic() error path
  ptp: ocp: Fix board ID over-read
  tls: rx: restore msg_iter before TLS 1.3 optimistic retry
  selftests: tls: add a test for splicing onto a full plaintext record
  tls: don't leave a full plaintext sk_msg ring unpushed
  xdp: reject clones that overrun skb_shared_info tailroom
  mptcp: reclaim forward-allocated memory on RX path errors
  mptcp: fastopen: only mark MPTFO subflows with SYN data
  mptcp: pm: fix memory leak from alloc-during-teardown race
  ...

packet_snd() reads dev->hard_header_len multiple times while allocating
and constructing an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.

For SOCK_RAW, packet_snd() can save a larger value in reserve and later
allocate headroom using a smaller value. Moving skb->data back by reserve
then places it before skb->head, and the following copy from userspace can
attempt an out-of-bounds write.

packet_sendmsg_spkt() has the same issue because it calculates its
reservation and header offset from separate reads before dropping the RCU
read lock to allocate the skb.

Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
Read hard_header_len once in packet_snd() and use it for allocation and
construction. In packet_sendmsg_spkt(), preserve the allocation-time value
through the device lookup retry.

The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.

Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260805125729.19220-3-q.h.hack.winter@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>