Lkft-triage June 2026

lkft-triage@lists.linaro.org

29 participants
18 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.37 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.37-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.37-rc1 Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: do not copy page tables unnecessarily for VM_UFFD_WP Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> testing/selftests/mm: add soft-dirty merge self-test Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: propagate VM_SOFTDIRTY on merge Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: set the VM_MAYBE_GUARD flag on guard region install Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: implement sticky VMA flags Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: update vma_modify_flags() to handle residual flags, document Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: add atomic VMA flags and set VM_MAYBE_GUARD as such Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix stm32 (and potentially others) resume regression Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/filesystems/proc.rst | 5 +- Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- drivers/acpi/scan.c | 41 +-- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm.c | 14 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/net_failover.c | 12 +- drivers/regulator/core.c | 10 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/proc/task_mmu.c | 1 + fs/smb/server/smb2pdu.c | 5 + include/linux/mm.h | 104 ++++++ include/net/rose.h | 12 + include/trace/events/mmflags.h | 1 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- lib/debugobjects.c | 58 ++- mm/khugepaged.c | 71 ++-- mm/madvise.c | 24 +- mm/memory.c | 16 +- mm/mlock.c | 2 +- mm/mprotect.c | 2 +- mm/mseal.c | 7 +- mm/vma.c | 81 +++-- mm/vma.h | 130 +++++-- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- net/sctp/ipv6.c | 2 + net/sctp/protocol.c | 2 + tools/testing/selftests/mm/soft-dirty.c | 127 ++++++- tools/testing/vma/vma.c | 3 +- tools/testing/vma/vma_internal.h | 49 +++ 63 files changed, 1023 insertions(+), 972 deletions(-)

3 months

[PATCH 7.0 00/49] 7.0.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.14 release. There are 49 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.14-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.14-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Weiming Shi <bestswngs(a)gmail.com> bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count number of commands in acpm_xfer NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Mark Rutland <mark.rutland(a)arm.com> arm64/entry: Fix arm64-specific rseq brokenness Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- arch/arm64/kernel/entry-common.c | 29 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm-dvfs.c | 12 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 14 +- drivers/firmware/samsung/exynos-acpm.c | 109 ++++-- drivers/firmware/samsung/exynos-acpm.h | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/net_failover.c | 12 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/smb/server/smb2pdu.c | 5 + include/linux/irq-entry-common.h | 8 - include/linux/lockd/lockd.h | 2 +- include/linux/rseq_entry.h | 19 - include/net/rose.h | 12 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- net/core/bpf_sk_storage.c | 13 +- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- 53 files changed, 567 insertions(+), 906 deletions(-)

3 months

[PATCH 7.1 00/21] 7.1.2-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.2 release. There are 21 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.2-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.2-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/smb/server/smb2pdu.c | 5 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- 28 files changed, 193 insertions(+), 749 deletions(-)

3 months, 1 week

[PATCH 7.1 0/8] 7.1.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.1 release. There are 8 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:55:16 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.1-rc1 Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Johan Hovold <johan(a)kernel.org> driver core: faux: fix root device registration Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 46 +++++++++++++++++++++++++++++ Makefile | 4 +-- arch/arm64/Kconfig | 38 ++++++++++++++++++++++++ arch/arm64/include/asm/cputype.h | 4 +++ arch/arm64/kernel/cpu_errata.c | 34 +++++++++++++++++++-- drivers/base/bus.c | 11 +++++-- drivers/base/faux.c | 22 +++++++------- fs/fcntl.c | 8 ++--- 8 files changed, 145 insertions(+), 22 deletions(-)

3 months, 2 weeks

[PATCH 7.0 000/378] 7.0.13-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.13 release. There are 378 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.13-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.13-rc1 Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Waiman Long <longman(a)redhat.com> debugobjects: Don't call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix skb overhead accounting to preserve full buf_alloc Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: tests: mark HT check strict Rio Liu <rio(a)r26.me> wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode Tejun Heo <tj(a)kernel.org> sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Jason Gunthorpe <jgg(a)ziepe.ca> RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Johan Hovold <johan(a)kernel.org> driver core: faux: fix root device registration Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Leorize <leorize+oss(a)disroot.org> drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Priya Hosur <Priya.Hosur(a)amd.com> drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit default/cap calculation Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems Vitaly Prosyak <vitaly.prosyak(a)amd.com> drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix waiting for all submissions for userptrs Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix global performance monitor reference counting Maíra Canal <mcanal(a)igalia.com> drm/v3d: Wait for pending L2T flush before cleaning caches Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu(a)intel.com> drm/xe: Clear pending_disable before signaling suspend fence Niranjana Vishwanathapura <niranjana.vishwanathapura(a)intel.com> drm/xe/multi_queue: skip submit when primary queue is suspended Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Andrew Martin <andrew.martin(a)amd.com> drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal <meatuni001(a)gmail.com> drm/amdkfd: fix NULL dereference in get_queue_ids() Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915: Fix color blob reference handling in intel_plane_state Simona Vetter <simona.vetter(a)ffwll.ch> drm/gem: Try to fix change_handle ioctl, attempt 4 Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Initialize controller resources in controller Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix probe error path ordering Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Justin Lai <justinlai0215(a)realtek.com> rtase: Reset TX subqueue when clearing TX ring Justin Lai <justinlai0215(a)realtek.com> rtase: Avoid sleeping in get_stats64() Kendall Willis <k-willis(a)ti.com> pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> pmdomain: imx: fix OF node refcount Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Huan He <hehuan1(a)eswincomputing.com> mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin EIC7700 Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Heiko Stuebner <heiko(a)sntech.de> mmc: dw_mmc-rockchip: Add missing private data for very old controllers Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Usama Arif <usama.arif(a)linux.dev> mm/mincore: handle non-swap entries before !CONFIG_SWAP guard Shakeel Butt <shakeel.butt(a)linux.dev> mm/list_lru: drain before clearing xarray entry on reparent David Carlier <devnexen(a)gmail.com> mm/hugetlb: restore reservation on error in hugetlb folio copy paths Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Lorenzo Stoakes <ljs(a)kernel.org> mm/huge_memory: use correct flags for device private PMD entry SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: handle ctx allocation failure SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: handle ctx allocation failure Muchun Song <muchun.song(a)linux.dev> mm/cma_debug: fix invalid accesses for inactive CMA areas Muchun Song <muchun.song(a)linux.dev> mm/cma: fix reserved page leak on activation failure Judith Mendez <jm(a)ti.com> pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider <a.heider(a)gmail.com> nvmem: layouts: onie-tlv: fix hang on unknown types Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> nvmem: core: fix use-after-free bugs in error paths Jonas Jelonek <jelonek.jonas(a)gmail.com> net: sfp: initialize i2c_block_size at adapter configure time Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() ZhaoJinming <zhaojinming(a)uniontech.com> net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix mailbox channel leak on probe error Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Alexander Dahl <ada(a)thorsis.com> memory: atmel-ebi: Allow deferred probing Shakeel Butt <shakeel.butt(a)linux.dev> memcg: use round-robin victim selection in refill_stock Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Jason Gunthorpe <jgg(a)ziepe.ca> iommu/dma: Do not try to iommu_map a 0 length region in swiotlb Joanne Koong <joannelkoong(a)gmail.com> iomap: avoid potential null folio->mapping deref during error reporting Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Carlos Song <carlos.song(a)nxp.com> i2c: imx: fix clock and pinctrl state inconsistency in runtime PM Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Arpith Kalaginanavoor <arpithk(a)nvidia.com> fs/qnx6: fix pointer arithmetic in directory iteration Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: reject NPU_OP_RESIZE commands from userspace Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: reject DMA commands with uninitialized length Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: fix arithmetic issues in dma_length() Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: fix IFM region index out-of-bounds in command stream parser Muhammad Bilal <meatuni001(a)gmail.com> accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() Heiko Carstens <hca(a)linux.ibm.com> s390: Remove GENERIC_LOCKBREAK Kconfig option Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Nirmoy Das <nirmoyd(a)nvidia.com> ovl: keep err zero after successful ovl_cache_get() Hyunwoo Kim <imv4bel(a)gmail.com> inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> spi: qcom-geni: Fix cs_change handling on the last transfer Amit Matityahu <amitmat(a)amazon.com> timers/migration: Fix livelock in tmigr_handle_remote_up() Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix rtgroup cleanup in CoW fork repair Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: add-addr: always drop other suboptions Tao Cui <cuitao(a)kylinos.cn> selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: set sockopt on all subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Gang Yan <yangang(a)kylinos.cn> mptcp: check desc->count in read_sock Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Alistair Popple <apopple(a)nvidia.com> arm64: mm: call pagetable dtor when freeing hot-removed page tables Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Cunlong Li <shenxiaogll(a)gmail.com> zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Yishai Hadas <yishaih(a)nvidia.com> RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/core: Validate the passed in fops for ib_get_ucaps() Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PUD counter before folio_put() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang <vulab(a)iscas.ac.cn> drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Clément Léger <cleger(a)meta.com> io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: don't truncate end buffer for bundles Christian A. Ehrhardt <lk(a)c--e.de> io_uring/wait: fix min_timeout behavior Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Forcibly close timer instances at closing HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Tristan Madani <tristmd(a)gmail.com> xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() Takao Sato <takaosato1997(a)gmail.com> xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Judith Mendez <jm(a)ti.com> pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Joey Gouly <joey.gouly(a)arm.com> KVM: arm64: Restore POR_EL0 access to host EL0 Oliver Upton <oupton(a)kernel.org> KVM: arm64: Correctly identify executable PTEs at stage-2 Oliver Upton <oupton(a)kernel.org> KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX Sean Christopherson <seanjc(a)google.com> KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA Sean Christopherson <seanjc(a)google.com> KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Wei Liu <wei.liu(a)kernel.org> mshv: add a missing padding field Nathan Chancellor <nathan(a)kernel.org> cfi: Include uaccess.h for get_kernel_nofault() Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Alice Ryhl <aliceryhl(a)google.com> rust: kasan/kbuild: fix rustc-option when cross-compiling Alice Ryhl <aliceryhl(a)google.com> rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Nathan Chancellor <nathan(a)kernel.org> ARM: Do not select HAVE_RUST when KASAN is enabled Miguel Ojeda <ojeda(a)kernel.org> rust: x86: support Rust >= 1.98.0 target spec Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu(a)intel.com> Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" Sun Shaojie <sunshaojie(a)kylinos.cn> cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Point the error offset correctly for eprobe argument error Eva Kurchatova <eva.kurchatova(a)virtuozzo.com> tracing: Fix CFI violation in probestub being called by tprobes Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add buffer overflow check in MS get_info_ioctl Dinh Nguyen <dinguyen(a)kernel.org> firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe Muhammad Amirul Asyraf Mohamad Jamian <muhammad.amirul.asyraf.mohamad.jamian(a)altera.com> firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported Muhammad Amirul Asyraf Mohamad Jamian <muhammad.amirul.asyraf.mohamad.jamian(a)altera.com> firmware: stratix10-svc: Don't fail probe when async ops unsupported Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add bounds checks for firmware log indices Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add bounds check for firmware runtime memory Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> Revert "drm/xe/nvls: Define GuC firmware for NVL-S" Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Georgiy Osokin <g.osokin(a)auroraos.dev> tee: shm: fix shm leak in register_shm_helper() Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Jann Horn <jannh(a)google.com> namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() Rodrigo Vivi <rodrigo.vivi(a)intel.com> drm/xe: fix job timeout recovery for unstarted jobs and kernel queues Wentao Liang <vulab(a)iscas.ac.cn> drm/xe: fix refcount leak in xe_range_fence_insert() Melissa Wen <mwen(a)igalia.com> drm/amd/display: use plane color_mgmt_changed to track colorop changes Melissa Wen <mwen(a)igalia.com> drm/atomic: track individual colorop updates Melissa Wen <mwen(a)igalia.com> drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable Alex Hung <alex.hung(a)amd.com> drm/colorop: Remove read-only comments from interpolation fields Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Fix driver removal with disabled KMS Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> drm/i915/edp: Check supported link rates DPCD read Pengyu Luo <mitltlatltl(a)gmail.com> clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Kuan-Wei Chiu <visitorckw(a)gmail.com> clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs Hans de Goede <johannes.goede(a)oss.qualcomm.com> clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked Kean Ren <rh_king(a)163.com> ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions Ido Schimmel <idosch(a)nvidia.com> ipv6: Fix a potential NPD in cleanup_prefix_route() Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: initialize PHY interface to 0 Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: distinguish module types by checking identifier Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: initialize module info buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Florian Westphal <fw(a)strlen.de> netfilter: revalidate bridge ports Felix Gu <ustc.gu(a)gmail.com> spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Vadim Fedorenko <vadim.fedorenko(a)linux.dev> ptp: ocp: fix resource freeing order Xiang Mei <xmei5(a)asu.edu> tun: zero the whole vnet header in tun_put_user() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Xin Long <lucien.xin(a)gmail.com> sctp: validate embedded INIT chunk and address list lengths in cookie Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: fix for ipc flags check Alessandro Schino <7991aleschino(a)gmail.com> esp: fix page frag reference leak on skb_to_sgvec failure Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: usb: fix race between urb completion and rx_retry cancellation Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: fix generic IRQ chip leak on remove Ruoyu Wang <ruoyuw560(a)gmail.com> gpio: zynq: fix runtime PM leak on remove Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Fushuai Wang <wangfushuai(a)baidu.com> net/mlx5: Use effective affinity mask for IRQ selection Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: don't try to setup PHY-driven SFP cages when using genphy Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: Clean the phy_ports after unregistering the downstream SFP bus Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: remove phy ports upon probe failure Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: clean the sfp upstream if phy probing fails Jakub Kicinski <kuba(a)kernel.org> netdev: fix double-free in netdev_nl_bind_rx_doit() Rosen Penev <rosenp(a)gmail.com> net: ibm: emac: Fix use-after-free during device removal Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive HanQuan <eilaimemedsnaimel(a)gmail.com> net: add pskb_may_pull() to skb_gro_receive_list() Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou <yun.zhou(a)windriver.com> gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Vikas Gupta <vikas.gupta(a)broadcom.com> bnge: fix context mem iteration Arthur Kiyanovski <akiyano(a)amazon.com> net: ena: PHC: Add missing barrier Alok Tiwari <alok.a.tiwari(a)oracle.com> idpf: fix mailbox capability for set device clock time Petr Oros <poros(a)redhat.com> ice: fix missing priority callbacks for U.FL DPLL pins Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Li RongQing <lirongqing(a)baidu.com> dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device Li RongQing <lirongqing(a)baidu.com> dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments Zhenghang Xiao <kipreyyy(a)gmail.com> xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload Richard Patel <ripatel(a)wii.dev> riscv: cfi: reject unknown flags in PR_SET_CFI Andreas Schwab <schwab(a)suse.de> riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Gabriele Monaco <gmonaco(a)redhat.com> verification/rvgen: Fix ltl2k writing True as a literal Gabriele Monaco <gmonaco(a)redhat.com> verification/rvgen: Fix options shared among commands Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix cleanup after failed trace setup Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix substring match when listing container monitors Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix substring match bug in monitor name search Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Ensure monitor name and desc are NUL-terminated Tomas Glozar <tglozar(a)redhat.com> rtla: Fix parsing of multi-character short options Zhan Xusheng <zhanxusheng1024(a)gmail.com> cpufreq/amd-pstate: drop stale @epp_cached kdoc Tony Luck <tony.luck(a)intel.com> x86/resctrl: Only check Intel systems for SNC Kyle Zeng <kylebot(a)openai.com> ALSA: seq: dummy: fix UMP event stack overread Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Qing Wang <wangqing7171(a)gmail.com> rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() Arnd Bergmann <arnd(a)arndb.de> crypto: s390 - add select CRYPTO_AEAD for aes NeilBrown <neilb(a)ownmail.net> VFS: fix possible failure to unlock in nfsd4_create_file() Dexuan Cui <decui(a)microsoft.com> hyperv: Clean up and fix the guest ID comment in hvgdk.h Arnd Bergmann <arnd(a)arndb.de> regulator: mt6363: select CONFIG_IRQ_DOMAIN Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Geliang Tang <geliang(a)kernel.org> selftests: harness: fix pidfd leak in __wait_for_test Michael Kelley <mhklinux(a)outlook.com> drm/hyperv: During panic do VMBus unload after frame buffer is flushed Michael Kelley <mhklinux(a)outlook.com> Drivers: hv: vmbus: Provide option to skip VMBus unload on panic Jakub Kicinski <kuba(a)kernel.org> Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" Pavan Chebbi <pavan.chebbi(a)broadcom.com> fwctl/bnxt_en: Refactor aux bus functions to be more generic Pavan Chebbi <pavan.chebbi(a)broadcom.com> fwctl/bnxt_en: Move common definitions to include/linux/bnxt/ Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Xin Long <lucien.xin(a)gmail.com> sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Antoine Tenart <atenart(a)kernel.org> geneve: fix length used in GRO hint UDP checksum adjustment Lorenzo Bianconi <lorenzo(a)kernel.org> net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Fix use-after-free in metadata dst teardown Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Jianyu Li <jianyu.li(a)mediatek.com> af_unix: Fix inq_len update problem in partial read Suman Ghosh <sumang(a)marvell.com> octeontx2-af: Fix initialization of mcam's entry2target_pffunc field Geetha sowjanya <gakula(a)marvell.com> octeontx2-pf: Fix NDC sync operation errors Jason Xing <kerneljasonxing(a)gmail.com> xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: enforce HE/EHT cap/oper consistency Johannes Berg <johannes.berg(a)intel.com> wifi: nl80211: split out UHR operation information Hari Chandrakanthan <quic_haric(a)quicinc.com> wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: fix leak if split 6 GHz scanning fails Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: anycast: insert aca into global hash under idev->lock Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima <kuniyu(a)google.com> tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Mark Bloch <mbloch(a)nvidia.com> devlink: Release nested relation on devlink free Lee Jones <lee(a)kernel.org> l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen <jiayuan.chen(a)linux.dev> netfilter: nft_ct: bail out on template ct in get eval Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares Gao Xiang <xiang(a)kernel.org> erofs: fix use-after-free on sbi->sync_decompress Linus Walleij <linusw(a)kernel.org> ARM: dts: gemini: Fix partition offsets Jan Polensky <japo(a)linux.ibm.com> s390/bug: Always emit format word in __BUG_ENTRY Robertus Diawan Chris <robertusdchris(a)gmail.com> tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() Arnd Bergmann <arnd(a)arndb.de> tee: fix tee_ioctl_object_invoke_arg padding Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Return -ENODEV if the ICE platform device is not found Mihai Sain <mihai.sain(a)microchip.com> ARM: dts: microchip: sam9x7: fix GMAC clock configuration Val Packett <val(a)packett.cool> arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins Harshal Dev <harshal.dev(a)oss.qualcomm.com> soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 48 +++ Makefile | 7 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/gemini/gemini-sl93512r.dts | 2 +- arch/arm/boot/dts/gemini/gemini-sq201.dts | 2 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 6 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 38 +++ arch/arm64/Makefile | 3 + arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 7 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/include/asm/kvm_nested.h | 4 +- arch/arm64/kernel/cpu_errata.c | 34 ++- arch/arm64/kvm/at.c | 6 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 4 +- arch/arm64/mm/mmu.c | 1 + arch/riscv/include/asm/usercfi.h | 1 + arch/riscv/kernel/ptrace.c | 2 +- arch/riscv/kernel/usercfi.c | 3 + arch/s390/Kconfig | 3 - arch/s390/crypto/Kconfig | 1 + arch/s390/include/asm/bug.h | 12 +- arch/x86/Makefile | 4 + arch/x86/Makefile.um | 8 + arch/x86/kernel/cpu/resctrl/monitor.c | 7 +- arch/x86/kvm/svm/sev.c | 27 +- drivers/accel/amdxdna/aie2_ctx.c | 3 + drivers/accel/ethosu/ethosu_gem.c | 35 ++- drivers/accel/ivpu/ivpu_fw.c | 16 + drivers/accel/ivpu/ivpu_fw_log.c | 5 + drivers/accel/ivpu/ivpu_ipc.c | 2 +- drivers/accel/ivpu/ivpu_ms.c | 7 + drivers/base/bus.c | 11 +- drivers/base/faux.c | 22 +- drivers/block/zram/zram_drv.c | 2 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/clk/qcom/dispcc-x1e80100.c | 2 +- drivers/clk/samsung/clk-gs101.c | 2 +- drivers/cpufreq/amd-pstate.h | 1 - drivers/firmware/samsung/exynos-acpm.c | 13 +- drivers/firmware/stratix10-rsu.c | 45 ++- drivers/firmware/stratix10-svc.c | 21 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-zynq.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 81 +++-- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 10 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 10 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 42 ++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - drivers/gpu/drm/drm_atomic.c | 4 +- drivers/gpu/drm/drm_atomic_uapi.c | 68 ++++- drivers/gpu/drm/drm_colorop.c | 16 +- drivers/gpu/drm/drm_gem.c | 73 +++-- drivers/gpu/drm/drm_ioctl.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 5 + drivers/gpu/drm/hyperv/hyperv_drm_modeset.c | 15 +- drivers/gpu/drm/i915/display/intel_dp.c | 11 +- drivers/gpu/drm/i915/display/intel_plane.c | 27 ++ drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 8 + drivers/gpu/drm/v3d/v3d_perfmon.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 17 +- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/gpu/drm/xe/xe_exec_queue.h | 17 -- drivers/gpu/drm/xe/xe_guc_submit.c | 111 +++---- drivers/gpu/drm/xe/xe_hw_engine_group.c | 10 +- drivers/gpu/drm/xe/xe_range_fence.c | 2 + drivers/gpu/drm/xe/xe_uc_fw.c | 1 - drivers/hv/channel_mgmt.c | 1 + drivers/hv/hv_kvp.c | 25 +- drivers/hv/hyperv_vmbus.h | 1 - drivers/hv/vmbus_drv.c | 54 +++- drivers/i2c/busses/i2c-imx-lpi2c.c | 53 ++-- drivers/i2c/busses/i2c-imx.c | 15 +- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 ++-- drivers/i2c/i2c-dev.c | 9 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++ drivers/infiniband/core/ucaps.c | 8 +- drivers/infiniband/core/umem.c | 16 + drivers/infiniband/core/uverbs_std_types_dmah.c | 5 + drivers/infiniband/core/verbs.c | 38 --- drivers/infiniband/hw/bnxt_re/debugfs.c | 2 +- drivers/infiniband/hw/bnxt_re/main.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/ionic/ionic_ibdev.h | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/keyboard/atkbd.c | 15 + drivers/iommu/dma-iommu.c | 19 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/memory/atmel-ebi.c | 3 +- drivers/misc/fastrpc.c | 107 ++++--- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/dw_mmc-rockchip.c | 17 ++ drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 44 +-- drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_3ad.c | 18 +- drivers/net/bonding/bond_main.c | 4 +- drivers/net/bonding/bond_netlink.c | 4 +- drivers/net/bonding/bond_procfs.c | 8 +- drivers/net/ethernet/airoha/airoha_eth.c | 5 +- drivers/net/ethernet/amazon/ena/ena_com.c | 5 + drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | 14 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 87 ++++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 19 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 10 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 337 +++++++++++++-------- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/ibm/emac/core.c | 9 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 2 + drivers/net/ethernet/intel/idpf/idpf_ptp.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 67 ++-- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 36 +-- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 +++-- drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c | 24 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 3 + drivers/net/geneve.c | 2 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/mctp/mctp-usb.c | 28 +- drivers/net/phy/phy_device.c | 24 +- drivers/net/phy/sfp.c | 1 + drivers/net/tun.c | 1 + drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 56 ++-- drivers/nvmem/core.c | 12 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 11 +- drivers/pmdomain/imx/gpc.c | 2 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 2 +- drivers/ptp/ptp_ocp.c | 24 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/regulator/Kconfig | 1 + drivers/slimbus/qcom-ngd-ctrl.c | 122 +++++--- drivers/soc/qcom/ice.c | 57 +++- drivers/spi/spi-geni-qcom.c | 27 +- drivers/spi/spi-rzv2h-rspi.c | 3 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 24 +- drivers/tee/optee/supp.c | 107 +++++-- drivers/tee/qcomtee/core.c | 6 +- drivers/tee/tee_shm.c | 2 +- drivers/thunderbolt/property.c | 6 + drivers/thunderbolt/xdomain.c | 14 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/option.c | 3 + fs/erofs/zdata.c | 6 +- fs/fcntl.c | 8 +- fs/fhandle.c | 16 +- fs/fuse/dev.c | 13 +- fs/iomap/buffered-io.c | 10 +- fs/mount.h | 10 +- fs/namei.c | 10 + fs/namespace.c | 9 +- fs/overlayfs/readdir.c | 7 +- fs/qnx6/dir.c | 8 +- fs/smb/server/oplock.c | 15 +- fs/smb/server/smb2pdu.c | 11 + fs/xfs/scrub/cow_repair.c | 12 +- include/drm/drm_atomic_uapi.h | 4 +- include/drm/drm_colorop.h | 34 +-- include/hyperv/hvgdk.h | 10 +- include/hyperv/hvhdk.h | 1 + .../bnxt/bnxt_ulp.h => include/linux/bnxt/ulp.h | 25 +- include/linux/cfi.h | 1 + include/linux/hugetlb.h | 8 - include/linux/hyperv.h | 3 + include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 - include/linux/rseq_entry.h | 5 +- include/linux/tracepoint.h | 8 + include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/cfg80211.h | 23 ++ include/net/ip_vs.h | 3 +- include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/sock.h | 1 + include/net/tc_act/tc_pedit.h | 1 - include/rdma/ib_umem.h | 44 +-- include/rdma/ib_verbs.h | 48 --- include/rdma/iter.h | 88 ++++++ include/uapi/linux/nl80211.h | 25 ++ include/uapi/linux/tee.h | 1 + io_uring/kbuf.c | 1 - io_uring/net.c | 3 +- io_uring/wait.c | 2 +- ipc/shm.c | 10 +- kernel/cgroup/cpuset.c | 13 +- kernel/dma/debug.c | 2 +- kernel/dma/direct.c | 2 +- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/pid.c | 8 +- kernel/sched/ext.c | 10 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/time/timer_migration.c | 8 +- kernel/trace/trace_probe.c | 2 - lib/debugobjects.c | 54 +++- mm/cma.c | 7 +- mm/cma_debug.c | 3 +- mm/damon/lru_sort.c | 4 + mm/damon/ops-common.c | 4 +- mm/damon/reclaim.c | 4 + mm/huge_memory.c | 49 ++- mm/hugetlb.c | 69 +++-- mm/list_lru.c | 21 +- mm/memcontrol.c | 5 +- mm/memory-failure.c | 19 +- mm/mincore.c | 10 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/bluetooth/bnep/core.c | 50 ++- net/bluetooth/hci_sync.c | 5 + net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/iso.c | 63 ++-- net/bluetooth/l2cap_core.c | 46 +++ net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 +++-- net/bluetooth/rfcomm/sock.c | 26 +- net/bluetooth/sco.c | 20 +- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/nft_meta_bridge.c | 2 + net/core/filter.c | 15 +- net/core/gro.c | 5 + net/core/netdev-genl.c | 4 +- net/core/skbuff.c | 6 +- net/core/sock.c | 13 +- net/devlink/core.c | 2 + net/hsr/hsr_framereg.c | 4 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/esp4.c | 17 +- net/ipv4/inet_connection_sock.c | 6 + net/ipv4/inet_fragment.c | 3 + net/ipv4/ip_fragment.c | 3 - net/ipv4/ip_options.c | 4 + net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/addrconf.c | 6 +- net/ipv6/anycast.c | 16 +- net/ipv6/esp6.c | 17 +- net/ipv6/ip6_vti.c | 3 + net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/sit.c | 1 + net/l2tp/l2tp_ppp.c | 92 +++--- net/mac80211/mlme.c | 9 + net/mac80211/tests/chan-mode.c | 1 + net/mac80211/tx.c | 4 +- net/mptcp/options.c | 73 ++--- net/mptcp/pm.c | 15 +- net/mptcp/pm_userspace.c | 14 +- net/mptcp/protocol.c | 10 + net/mptcp/protocol.h | 7 +- net/mptcp/sockopt.c | 15 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 24 +- net/netfilter/nfnetlink_log.c | 23 +- net/netfilter/nfnetlink_queue.c | 64 +++- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +- net/openvswitch/datapath.c | 1 + net/phonet/pn_dev.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/input.c | 26 +- net/sched/act_api.c | 7 +- net/sched/act_pedit.c | 77 ++--- net/sctp/bind_addr.c | 11 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_make_chunk.c | 12 +- net/sctp/sm_statefuns.c | 6 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 17 +- net/socket.c | 11 +- net/unix/af_unix.c | 11 +- net/vmw_vsock/virtio_transport_common.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 73 ++++- net/wireless/scan.c | 9 +- net/wireless/trace.h | 19 ++ net/xdp/xsk.c | 11 +- net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_iptfs.c | 11 +- net/xfrm/xfrm_policy.c | 13 +- scripts/Makefile.compiler | 2 +- scripts/generate_rust_target.rs | 8 +- sound/core/pcm_native.c | 7 +- sound/core/seq/seq_dummy.c | 15 +- sound/core/timer.c | 17 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/sdca/sdca_function_device.c | 24 +- sound/soc/sof/amd/acp-ipc.c | 4 +- sound/soc/sof/amd/acp.h | 2 + .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/kselftest_harness.h | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/testing/selftests/riscv/cfi/cfitests.c | 6 + tools/tracing/rtla/src/common.c | 28 +- tools/tracing/rtla/src/common.h | 12 +- tools/tracing/rtla/src/osnoise_hist.c | 7 +- tools/tracing/rtla/src/osnoise_top.c | 7 +- tools/tracing/rtla/src/timerlat_hist.c | 7 +- tools/tracing/rtla/src/timerlat_top.c | 7 +- tools/verification/rv/src/in_kernel.c | 67 ++-- tools/verification/rvgen/__main__.py | 10 +- tools/verification/rvgen/rvgen/ltl2ba.py | 9 +- virt/kvm/kvm_main.c | 3 +- 396 files changed, 3849 insertions(+), 1908 deletions(-)

3 months, 2 weeks

[PATCH 6.18 000/325] 6.18.36-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.36 release. There are 325 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.36-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.36-rc1 Damien Le Moal <dlemoal(a)kernel.org> block: fix handling of dead zone write plugs Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix skb overhead accounting to preserve full buf_alloc Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Jason Gunthorpe <jgg(a)ziepe.ca> RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add helpers for umem dmabuf revoke lock Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Move umem dmabuf revoke logic into helper function Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Tejun Heo <tj(a)kernel.org> sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: tests: mark HT check strict Rio Liu <rio(a)r26.me> wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Leorize <leorize+oss(a)disroot.org> drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Priya Hosur <Priya.Hosur(a)amd.com> drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit default/cap calculation Vitaly Prosyak <vitaly.prosyak(a)amd.com> drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix waiting for all submissions for userptrs Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix global performance monitor reference counting Maíra Canal <mcanal(a)igalia.com> drm/v3d: Wait for pending L2T flush before cleaning caches Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu(a)intel.com> drm/xe: Clear pending_disable before signaling suspend fence Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Andrew Martin <andrew.martin(a)amd.com> drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal <meatuni001(a)gmail.com> drm/amdkfd: fix NULL dereference in get_queue_ids() Simona Vetter <simona.vetter(a)ffwll.ch> drm/gem: Try to fix change_handle ioctl, attempt 4 Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Initialize controller resources in controller Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix probe error path ordering Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Justin Lai <justinlai0215(a)realtek.com> rtase: Reset TX subqueue when clearing TX ring Justin Lai <justinlai0215(a)realtek.com> rtase: Avoid sleeping in get_stats64() Kendall Willis <k-willis(a)ti.com> pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> pmdomain: imx: fix OF node refcount Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Heiko Stuebner <heiko(a)sntech.de> mmc: dw_mmc-rockchip: Add missing private data for very old controllers Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Usama Arif <usama.arif(a)linux.dev> mm/mincore: handle non-swap entries before !CONFIG_SWAP guard Shakeel Butt <shakeel.butt(a)linux.dev> mm/list_lru: drain before clearing xarray entry on reparent David Carlier <devnexen(a)gmail.com> mm/hugetlb: restore reservation on error in hugetlb folio copy paths Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: handle ctx allocation failure SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: handle ctx allocation failure Muchun Song <muchun.song(a)linux.dev> mm/cma_debug: fix invalid accesses for inactive CMA areas Muchun Song <muchun.song(a)linux.dev> mm/cma: fix reserved page leak on activation failure Christian A. Ehrhardt <lk(a)c--e.de> io_uring/wait: fix min_timeout behavior Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: don't truncate end buffer for bundles Judith Mendez <jm(a)ti.com> pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider <a.heider(a)gmail.com> nvmem: layouts: onie-tlv: fix hang on unknown types Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> nvmem: core: fix use-after-free bugs in error paths Jonas Jelonek <jelonek.jonas(a)gmail.com> net: sfp: initialize i2c_block_size at adapter configure time Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() ZhaoJinming <zhaojinming(a)uniontech.com> net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix mailbox channel leak on probe error Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Shakeel Butt <shakeel.butt(a)linux.dev> memcg: use round-robin victim selection in refill_stock Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Jason Gunthorpe <jgg(a)ziepe.ca> iommu/dma: Do not try to iommu_map a 0 length region in swiotlb Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Carlos Song <carlos.song(a)nxp.com> i2c: imx: fix clock and pinctrl state inconsistency in runtime PM Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Arpith Kalaginanavoor <arpithk(a)nvidia.com> fs/qnx6: fix pointer arithmetic in directory iteration Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Hyunwoo Kim <imv4bel(a)gmail.com> inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Amit Matityahu <amitmat(a)amazon.com> timers/migration: Fix livelock in tmigr_handle_remote_up() Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix rtgroup cleanup in CoW fork repair Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: add-addr: always drop other suboptions Tao Cui <cuitao(a)kylinos.cn> selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: set sockopt on all subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Alistair Popple <apopple(a)nvidia.com> arm64: mm: call pagetable dtor when freeing hot-removed page tables Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Cunlong Li <shenxiaogll(a)gmail.com> zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Yishai Hadas <yishaih(a)nvidia.com> RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/core: Validate the passed in fops for ib_get_ucaps() Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PUD counter before folio_put() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang <vulab(a)iscas.ac.cn> drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Clément Léger <cleger(a)meta.com> io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Forcibly close timer instances at closing HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Tristan Madani <tristmd(a)gmail.com> xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() Takao Sato <takaosato1997(a)gmail.com> xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Joey Gouly <joey.gouly(a)arm.com> KVM: arm64: Restore POR_EL0 access to host EL0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA Sean Christopherson <seanjc(a)google.com> KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Wei Liu <wei.liu(a)kernel.org> mshv: add a missing padding field Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Alice Ryhl <aliceryhl(a)google.com> rust: kasan/kbuild: fix rustc-option when cross-compiling Alice Ryhl <aliceryhl(a)google.com> rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Nathan Chancellor <nathan(a)kernel.org> ARM: Do not select HAVE_RUST when KASAN is enabled Miguel Ojeda <ojeda(a)kernel.org> rust: x86: support Rust >= 1.98.0 target spec Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Point the error offset correctly for eprobe argument error Eva Kurchatova <eva.kurchatova(a)virtuozzo.com> tracing: Fix CFI violation in probestub being called by tprobes Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add buffer overflow check in MS get_info_ioctl Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add bounds checks for firmware log indices Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Georgiy Osokin <g.osokin(a)auroraos.dev> tee: shm: fix shm leak in register_shm_helper() Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() Wentao Liang <vulab(a)iscas.ac.cn> drm/xe: fix refcount leak in xe_range_fence_insert() Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Fix driver removal with disabled KMS Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> drm/i915/edp: Check supported link rates DPCD read Pengyu Luo <mitltlatltl(a)gmail.com> clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Kuan-Wei Chiu <visitorckw(a)gmail.com> clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs Hans de Goede <johannes.goede(a)oss.qualcomm.com> clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked Dongli Zhang <dongli.zhang(a)oracle.com> KVM: VMX: Update SVI during runtime APICv activation Ido Schimmel <idosch(a)nvidia.com> ipv6: Fix a potential NPD in cleanup_prefix_route() Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: initialize module info buffer Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: rename the SFP related Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: support CR modules for AML devices Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: optimize the flow to setup PHY for AML devices Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Florian Westphal <fw(a)strlen.de> netfilter: revalidate bridge ports Felix Gu <ustc.gu(a)gmail.com> spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Xiang Mei <xmei5(a)asu.edu> tun: zero the whole vnet header in tun_put_user() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Xin Long <lucien.xin(a)gmail.com> sctp: validate embedded INIT chunk and address list lengths in cookie Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: fix for ipc flags check Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: usb: fix race between urb completion and rx_retry cancellation Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: fix generic IRQ chip leak on remove Ruoyu Wang <ruoyuw560(a)gmail.com> gpio: zynq: fix runtime PM leak on remove Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Fushuai Wang <wangfushuai(a)baidu.com> net/mlx5: Use effective affinity mask for IRQ selection Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: clean the sfp upstream if phy probing fails Jakub Kicinski <kuba(a)kernel.org> netdev: fix double-free in netdev_nl_bind_rx_doit() Rosen Penev <rosenp(a)gmail.com> net: ibm: emac: Fix use-after-free during device removal Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive HanQuan <eilaimemedsnaimel(a)gmail.com> net: add pskb_may_pull() to skb_gro_receive_list() Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou <yun.zhou(a)windriver.com> gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Vikas Gupta <vikas.gupta(a)broadcom.com> bnge: fix context mem iteration Arthur Kiyanovski <akiyano(a)amazon.com> net: ena: PHC: Add missing barrier Alok Tiwari <alok.a.tiwari(a)oracle.com> idpf: fix mailbox capability for set device clock time Petr Oros <poros(a)redhat.com> ice: fix missing priority callbacks for U.FL DPLL pins Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Li RongQing <lirongqing(a)baidu.com> dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device Li RongQing <lirongqing(a)baidu.com> dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments Zhenghang Xiao <kipreyyy(a)gmail.com> xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Gabriele Monaco <gmonaco(a)redhat.com> verification/rvgen: Fix ltl2k writing True as a literal Gabriele Monaco <gmonaco(a)redhat.com> verification/rvgen: Fix options shared among commands Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix cleanup after failed trace setup Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix substring match when listing container monitors Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix substring match bug in monitor name search Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Ensure monitor name and desc are NUL-terminated Zhan Xusheng <zhanxusheng1024(a)gmail.com> cpufreq/amd-pstate: drop stale @epp_cached kdoc Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix unclocked access on unbind Kyle Zeng <kylebot(a)openai.com> ALSA: seq: dummy: fix UMP event stack overread Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Dexuan Cui <decui(a)microsoft.com> hyperv: Clean up and fix the guest ID comment in hvgdk.h Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Geliang Tang <geliang(a)kernel.org> selftests: harness: fix pidfd leak in __wait_for_test Michael Kelley <mhklinux(a)outlook.com> drm/hyperv: During panic do VMBus unload after frame buffer is flushed Michael Kelley <mhklinux(a)outlook.com> Drivers: hv: vmbus: Provide option to skip VMBus unload on panic Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: VMBus protocol version 6.0 Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Xin Long <lucien.xin(a)gmail.com> sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Lorenzo Bianconi <lorenzo(a)kernel.org> net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Fix use-after-free in metadata dst teardown Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Jianyu Li <jianyu.li(a)mediatek.com> af_unix: Fix inq_len update problem in partial read Suman Ghosh <sumang(a)marvell.com> octeontx2-af: Fix initialization of mcam's entry2target_pffunc field Geetha sowjanya <gakula(a)marvell.com> octeontx2-pf: Fix NDC sync operation errors Jason Xing <kernelxing(a)tencent.com> xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: fix leak if split 6 GHz scanning fails Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: anycast: insert aca into global hash under idev->lock Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Mark Bloch <mbloch(a)nvidia.com> devlink: Release nested relation on devlink free Lee Jones <lee(a)kernel.org> l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen <jiayuan.chen(a)linux.dev> netfilter: nft_ct: bail out on template ct in get eval Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares Gao Xiang <xiang(a)kernel.org> erofs: fix use-after-free on sbi->sync_decompress Gao Xiang <xiang(a)kernel.org> erofs: tidy up synchronous decompression Robertus Diawan Chris <robertusdchris(a)gmail.com> tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() Arnd Bergmann <arnd(a)arndb.de> tee: fix tee_ioctl_object_invoke_arg padding Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Return -ENODEV if the ICE platform device is not found Mihai Sain <mihai.sain(a)microchip.com> ARM: dts: microchip: sam9x7: fix GMAC clock configuration Val Packett <val(a)packett.cool> arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins Harshal Dev <harshal.dev(a)oss.qualcomm.com> soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. ------------- Diffstat: Documentation/ABI/testing/sysfs-fs-erofs | 14 ++- Documentation/arch/arm64/silicon-errata.rst | 46 +++++++ Makefile | 7 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 6 +- arch/arm/include/asm/io.h | 15 ++- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm/mm/alignment.c | 6 +- arch/arm/mm/fault.c | 100 +++++++++++---- arch/arm64/Kconfig | 38 ++++++ arch/arm64/Makefile | 3 + arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 7 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/kernel/cpu_errata.c | 34 ++++- arch/arm64/kvm/at.c | 6 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/mm/mmu.c | 1 + arch/x86/Makefile | 4 + arch/x86/Makefile.um | 8 ++ arch/x86/kvm/svm/sev.c | 27 ++-- arch/x86/kvm/vmx/vmx.c | 9 -- arch/x86/kvm/x86.c | 7 ++ block/blk-zoned.c | 32 ++++- drivers/accel/amdxdna/aie2_ctx.c | 3 + drivers/accel/ivpu/ivpu_fw_log.c | 5 + drivers/accel/ivpu/ivpu_ipc.c | 2 +- drivers/accel/ivpu/ivpu_ms.c | 7 ++ drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/clk/qcom/dispcc-x1e80100.c | 2 +- drivers/clk/samsung/clk-gs101.c | 2 +- drivers/cpufreq/amd-pstate.h | 1 - drivers/firmware/samsung/exynos-acpm.c | 13 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-zynq.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 81 ++++++++---- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 10 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 10 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 32 ++--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 ++--- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - drivers/gpu/drm/drm_gem.c | 73 +++++------ drivers/gpu/drm/drm_ioctl.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 5 + drivers/gpu/drm/hyperv/hyperv_drm_modeset.c | 15 +-- drivers/gpu/drm/i915/display/intel_dp.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 8 ++ drivers/gpu/drm/v3d/v3d_perfmon.c | 24 +++- drivers/gpu/drm/v3d/v3d_sched.c | 17 ++- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- drivers/gpu/drm/xe/xe_range_fence.c | 2 + drivers/hv/channel_mgmt.c | 1 + drivers/hv/hyperv_vmbus.h | 3 +- drivers/hv/vmbus_drv.c | 37 ++++-- drivers/i2c/busses/i2c-imx-lpi2c.c | 53 ++++---- drivers/i2c/busses/i2c-imx.c | 15 ++- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 ++++---- drivers/i2c/i2c-dev.c | 9 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++++ drivers/infiniband/core/ucaps.c | 8 +- drivers/infiniband/core/umem.c | 16 +++ drivers/infiniband/core/umem_dmabuf.c | 77 +++++++++--- drivers/infiniband/core/uverbs_std_types_dmah.c | 5 + drivers/infiniband/core/verbs.c | 38 ------ drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/ionic/ionic_ibdev.h | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 ++++- drivers/input/keyboard/atkbd.c | 15 +++ drivers/iommu/dma-iommu.c | 19 ++- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/misc/fastrpc.c | 107 ++++++++++------ drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/dw_mmc-rockchip.c | 17 +++ drivers/mmc/host/litex_mmc.c | 20 ++- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 4 +- drivers/net/ethernet/airoha/airoha_eth.c | 5 +- drivers/net/ethernet/amazon/ena/ena_com.c | 5 + drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | 14 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/ibm/emac/core.c | 9 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 2 + drivers/net/ethernet/intel/idpf/idpf_ptp.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 67 ++++++---- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 36 +++--- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 ++++++++--- drivers/net/ethernet/microchip/lan743x_main.c | 32 +++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 4 +- drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c | 140 +++++++++++---------- drivers/net/ethernet/wangxun/txgbe/txgbe_aml.h | 2 +- drivers/net/ethernet/wangxun/txgbe/txgbe_ethtool.c | 5 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 12 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 13 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/mctp/mctp-usb.c | 28 +++-- drivers/net/phy/phy_device.c | 6 + drivers/net/phy/sfp.c | 1 + drivers/net/tap.c | 2 + drivers/net/tun.c | 1 + drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 56 +++++---- drivers/nvmem/core.c | 12 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 6 +- drivers/pmdomain/imx/gpc.c | 2 +- drivers/pmdomain/ti/ti_sci_pm_domains.c | 2 +- drivers/ptp/ptp_vclock.c | 14 ++- drivers/slimbus/qcom-ngd-ctrl.c | 122 +++++++++++------- drivers/soc/qcom/ice.c | 57 +++++++-- drivers/spi/spi-cadence-quadspi.c | 5 +- drivers/spi/spi-rzv2h-rspi.c | 3 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tee/optee/supp.c | 107 +++++++++++----- drivers/tee/qcomtee/core.c | 6 +- drivers/tee/tee_shm.c | 2 +- drivers/thunderbolt/property.c | 6 + drivers/thunderbolt/xdomain.c | 14 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/option.c | 3 + fs/erofs/internal.h | 5 +- fs/erofs/super.c | 3 +- fs/erofs/sysfs.c | 2 +- fs/erofs/zdata.c | 35 ++---- fs/fcntl.c | 8 +- fs/fhandle.c | 16 ++- fs/fuse/dev.c | 13 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/qnx6/dir.c | 8 +- fs/smb/server/oplock.c | 15 ++- fs/smb/server/smb2pdu.c | 11 ++ fs/xfs/scrub/cow_repair.c | 12 +- include/hyperv/hvgdk.h | 10 +- include/hyperv/hvgdk_mini.h | 1 + include/hyperv/hvhdk.h | 1 + include/linux/hugetlb.h | 8 -- include/linux/hyperv.h | 72 ++++++++--- include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 -- include/linux/tracepoint.h | 8 ++ include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/ip_vs.h | 3 +- include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/sock.h | 1 + include/net/tc_act/tc_pedit.h | 1 - include/rdma/ib_umem.h | 48 +++---- include/rdma/ib_verbs.h | 48 ------- include/rdma/iter.h | 88 +++++++++++++ include/uapi/linux/tee.h | 1 + io_uring/io_uring.c | 2 +- io_uring/kbuf.c | 1 - io_uring/net.c | 3 +- ipc/shm.c | 10 +- kernel/dma/debug.c | 2 +- kernel/dma/direct.c | 2 +- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/pid.c | 8 +- kernel/sched/ext.c | 10 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/time/timer_migration.c | 8 +- kernel/trace/trace_probe.c | 2 - mm/cma.c | 7 +- mm/cma_debug.c | 3 +- mm/damon/lru_sort.c | 4 + mm/damon/ops-common.c | 4 +- mm/damon/reclaim.c | 4 + mm/huge_memory.c | 4 +- mm/hugetlb.c | 69 +++++----- mm/list_lru.c | 21 ++-- mm/memcontrol.c | 5 +- mm/memory-failure.c | 19 +-- mm/mincore.c | 10 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/bluetooth/bnep/core.c | 50 +++++--- net/bluetooth/hci_sync.c | 5 + net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/iso.c | 61 ++++++--- net/bluetooth/l2cap_core.c | 46 +++++++ net/bluetooth/mgmt.c | 17 +-- net/bluetooth/rfcomm/core.c | 69 +++++++--- net/bluetooth/rfcomm/sock.c | 26 +++- net/bluetooth/sco.c | 20 ++- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 ++- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/nft_meta_bridge.c | 2 + net/core/filter.c | 15 ++- net/core/gro.c | 5 + net/core/netdev-genl.c | 4 +- net/core/skbuff.c | 6 +- net/core/sock.c | 13 +- net/devlink/core.c | 2 + net/hsr/hsr_framereg.c | 4 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/inet_fragment.c | 3 + net/ipv4/ip_fragment.c | 3 - net/ipv4/ip_options.c | 4 + net/ipv4/netfilter/arp_tables.c | 15 +-- net/ipv4/netfilter/ip_tables.c | 15 +-- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/udp.c | 8 ++ net/ipv6/addrconf.c | 6 +- net/ipv6/anycast.c | 16 +-- net/ipv6/ip6_vti.c | 3 + net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +-- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/sit.c | 1 + net/l2tp/l2tp_ppp.c | 92 ++++++++------ net/mac80211/mlme.c | 9 ++ net/mac80211/tests/chan-mode.c | 1 + net/mac80211/tx.c | 4 +- net/mptcp/options.c | 73 +++++------ net/mptcp/pm.c | 15 +-- net/mptcp/pm_userspace.c | 14 ++- net/mptcp/protocol.c | 4 + net/mptcp/protocol.h | 7 +- net/mptcp/sockopt.c | 15 ++- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 ++-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 ++- net/netfilter/ipvs/ip_vs_sched.c | 14 +-- net/netfilter/nf_conntrack_helper.c | 19 +++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 24 +++- net/netfilter/nfnetlink_log.c | 23 +++- net/netfilter/nfnetlink_queue.c | 64 ++++++++-- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++--- net/openvswitch/datapath.c | 1 + net/phonet/pn_dev.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/input.c | 26 ++-- net/sched/act_api.c | 7 +- net/sched/act_pedit.c | 77 ++++++------ net/sctp/bind_addr.c | 11 +- net/sctp/diag.c | 17 +-- net/sctp/input.c | 8 ++ net/sctp/sm_make_chunk.c | 12 +- net/sctp/sm_statefuns.c | 6 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 17 ++- net/socket.c | 11 +- net/unix/af_unix.c | 11 +- net/vmw_vsock/virtio_transport_common.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 3 + net/wireless/scan.c | 9 +- net/xdp/xsk.c | 11 +- net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_iptfs.c | 11 +- net/xfrm/xfrm_policy.c | 13 +- scripts/Makefile.compiler | 2 +- scripts/generate_rust_target.rs | 8 +- sound/core/pcm_native.c | 7 +- sound/core/seq/seq_dummy.c | 15 ++- sound/core/timer.c | 17 +-- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/sof/amd/acp-ipc.c | 4 +- sound/soc/sof/amd/acp.h | 2 + .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/kselftest_harness.h | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/verification/rv/src/in_kernel.c | 67 +++++----- tools/verification/rvgen/__main__.py | 10 +- tools/verification/rvgen/rvgen/ltl2ba.py | 9 +- virt/kvm/kvm_main.c | 3 +- 348 files changed, 3127 insertions(+), 1574 deletions(-)

3 months, 2 weeks

[PATCH 6.12 000/261] 6.12.94-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.94 release. There are 261 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.94-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.94-rc1 Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Eric Dumazet <edumazet(a)google.com> tcp: secure_seq: add back ports to TS offset Eric Dumazet <edumazet(a)google.com> tcp: use EXPORT_IPV6_MOD[_GPL]() Eric Dumazet <edumazet(a)google.com> net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Damien Le Moal <dlemoal(a)kernel.org> block: fix handling of dead zone write plugs Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix skb overhead accounting to preserve full buf_alloc Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Jason Gunthorpe <jgg(a)ziepe.ca> RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add helpers for umem dmabuf revoke lock Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Move umem dmabuf revoke logic into helper function Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Tejun Heo <tj(a)kernel.org> sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Leorize <leorize+oss(a)disroot.org> drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Priya Hosur <Priya.Hosur(a)amd.com> drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit default/cap calculation Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu(a)intel.com> drm/xe: Clear pending_disable before signaling suspend fence Andrew Martin <andrew.martin(a)amd.com> drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal <meatuni001(a)gmail.com> drm/amdkfd: fix NULL dereference in get_queue_ids() Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Initialize controller resources in controller Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix probe error path ordering Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Justin Lai <justinlai0215(a)realtek.com> rtase: Reset TX subqueue when clearing TX ring Justin Lai <justinlai0215(a)realtek.com> rtase: Avoid sleeping in get_stats64() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> pmdomain: imx: fix OF node refcount Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Heiko Stuebner <heiko(a)sntech.de> mmc: dw_mmc-rockchip: Add missing private data for very old controllers Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type David Carlier <devnexen(a)gmail.com> mm/hugetlb: restore reservation on error in hugetlb folio copy paths Christian A. Ehrhardt <lk(a)c--e.de> io_uring/wait: fix min_timeout behavior Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: don't truncate end buffer for bundles Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider <a.heider(a)gmail.com> nvmem: layouts: onie-tlv: fix hang on unknown types Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> nvmem: core: fix use-after-free bugs in error paths Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Arpith Kalaginanavoor <arpithk(a)nvidia.com> fs/qnx6: fix pointer arithmetic in directory iteration Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Hyunwoo Kim <imv4bel(a)gmail.com> inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Amit Matityahu <amitmat(a)amazon.com> timers/migration: Fix livelock in tmigr_handle_remote_up() Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: add-addr: always drop other suboptions Tao Cui <cuitao(a)kylinos.cn> selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Cunlong Li <shenxiaogll(a)gmail.com> zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang <vulab(a)iscas.ac.cn> drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Clément Léger <cleger(a)meta.com> io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Forcibly close timer instances at closing HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Judith Mendez <jm(a)ti.com> pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Sean Christopherson <seanjc(a)google.com> KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA Sean Christopherson <seanjc(a)google.com> KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Alice Ryhl <aliceryhl(a)google.com> rust: kasan/kbuild: fix rustc-option when cross-compiling Alice Ryhl <aliceryhl(a)google.com> rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Miguel Ojeda <ojeda(a)kernel.org> rust: x86: support Rust >= 1.98.0 target spec Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Point the error offset correctly for eprobe argument error Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add buffer overflow check in MS get_info_ioctl Andrzej Kacprowski <andrzej.kacprowski(a)linux.intel.com> accel/ivpu: Add bounds checks for firmware log indices Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Georgiy Osokin <g.osokin(a)auroraos.dev> tee: shm: fix shm leak in register_shm_helper() Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Wentao Liang <vulab(a)iscas.ac.cn> drm/xe: fix refcount leak in xe_range_fence_insert() Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Fix driver removal with disabled KMS Pengyu Luo <mitltlatltl(a)gmail.com> clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Kuan-Wei Chiu <visitorckw(a)gmail.com> clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs Hans de Goede <johannes.goede(a)oss.qualcomm.com> clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked Dongli Zhang <dongli.zhang(a)oracle.com> KVM: VMX: Update SVI during runtime APICv activation Qi Tang <tpluszz77(a)gmail.com> xfrm: hold dev ref until after transport_finish NF_HOOK Jianbo Liu <jianbol(a)nvidia.com> xfrm: hold device only for the asynchronous decryption Jan Kara <jack(a)suse.cz> writeback: Fix use after free in inode_switch_wbs_work_fn() Jan Kara <jack(a)suse.cz> writeback: Avoid contention on wb->list_lock when switching inodes Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack Ido Schimmel <idosch(a)nvidia.com> ipv6: Fix a potential NPD in cleanup_prefix_route() Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Florian Westphal <fw(a)strlen.de> netfilter: revalidate bridge ports Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Ruoyu Wang <ruoyuw560(a)gmail.com> gpio: zynq: fix runtime PM leak on remove Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Fushuai Wang <wangfushuai(a)baidu.com> net/mlx5: Use effective affinity mask for IRQ selection Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: clean the sfp upstream if phy probing fails Jakub Kicinski <kuba(a)kernel.org> netdev: fix double-free in netdev_nl_bind_rx_doit() Rosen Penev <rosenp(a)gmail.com> net: ibm: emac: Fix use-after-free during device removal Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive HanQuan <eilaimemedsnaimel(a)gmail.com> net: add pskb_may_pull() to skb_gro_receive_list() Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou <yun.zhou(a)windriver.com> gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Li RongQing <lirongqing(a)baidu.com> dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device Brian Foster <bfoster(a)redhat.com> iomap: don't revert iov_iter on partially completed buffered writes Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix cleanup after failed trace setup Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix unclocked access on unbind Steven Chen <chenste(a)linux.microsoft.com> ima: kexec: move IMA log copy from kexec load to execute Steven Chen <chenste(a)linux.microsoft.com> ima: kexec: skip IMA segment validation after kexec soft reboot Kyle Zeng <kylebot(a)openai.com> ALSA: seq: dummy: fix UMP event stack overread Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Rui Qi <qirui.001(a)bytedance.com> ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Eric Dumazet <edumazet(a)google.com> net_sched: act_pedit: use RCU in tcf_pedit_dump() Lorenzo Bianconi <lorenzo(a)kernel.org> net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Suman Ghosh <sumang(a)marvell.com> octeontx2-af: Fix initialization of mcam's entry2target_pffunc field Geetha sowjanya <gakula(a)marvell.com> octeontx2-pf: Fix NDC sync operation errors Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not using bc_sid as advertisement SID Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Mark Bloch <mbloch(a)nvidia.com> devlink: Release nested relation on devlink free Lee Jones <lee(a)kernel.org> l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen <jiayuan.chen(a)linux.dev> netfilter: nft_ct: bail out on template ct in get eval Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Gao Xiang <xiang(a)kernel.org> erofs: fix use-after-free on sbi->sync_decompress Gao Xiang <xiang(a)kernel.org> erofs: tidy up synchronous decompression Chunhai Guo <guochunhai(a)vivo.com> erofs: add sysfs node to drop internal caches Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Return -ENODEV if the ICE platform device is not found Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Johannes Berg <johannes.berg(a)intel.com> wifi: remove zero-length arrays Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. ------------- Diffstat: Documentation/ABI/testing/sysfs-fs-erofs | 25 ++++- Documentation/arch/arm64/silicon-errata.rst | 48 ++++++++ Makefile | 7 +- arch/arm/include/asm/io.h | 15 ++- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm/mm/alignment.c | 6 +- arch/arm/mm/fault.c | 100 ++++++++++++----- arch/arm64/Kconfig | 50 +++++++++ arch/arm64/Makefile | 3 + arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/tlbflush.h | 63 ++++++----- arch/arm64/kernel/cpu_errata.c | 34 +++++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 8 +- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 10 +- arch/x86/Makefile | 4 + arch/x86/Makefile.um | 8 ++ arch/x86/kvm/svm/sev.c | 27 ++--- arch/x86/kvm/vmx/vmx.c | 9 -- arch/x86/kvm/x86.c | 7 ++ block/blk-zoned.c | 32 +++++- drivers/accel/ivpu/ivpu_fw_log.c | 5 + drivers/accel/ivpu/ivpu_ipc.c | 2 +- drivers/accel/ivpu/ivpu_ms.c | 7 ++ drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 29 +++-- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/clk/qcom/dispcc-x1e80100.c | 2 +- drivers/clk/samsung/clk-gs101.c | 2 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-zynq.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 +++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 81 +++++++++----- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 10 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 10 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 32 +++--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 +++--- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_sched.c | 3 +- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 ++- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- drivers/gpu/drm/xe/xe_range_fence.c | 2 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++++---- drivers/i2c/i2c-dev.c | 9 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 ++++++++ drivers/infiniband/core/umem.c | 16 +++ drivers/infiniband/core/umem_dmabuf.c | 77 ++++++++++--- drivers/infiniband/core/verbs.c | 38 ------- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 ++++- drivers/input/keyboard/atkbd.c | 15 +++ drivers/mailbox/mailbox.c | 15 +-- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/misc/fastrpc.c | 107 +++++++++++------- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/dw_mmc-rockchip.c | 17 +++ drivers/mmc/host/litex_mmc.c | 20 +++- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 4 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/ibm/emac/core.c | 9 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 ++++++++----- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 36 +++--- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +-- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 +++++++++--- drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 7 +- drivers/net/hyperv/netvsc.c | 19 +++- drivers/net/phy/micrel.c | 15 +-- drivers/net/phy/phy_device.c | 6 + drivers/net/tap.c | 2 + drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/nvmem/core.c | 12 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 5 +- drivers/pmdomain/imx/gpc.c | 2 +- drivers/ptp/ptp_vclock.c | 14 ++- drivers/slimbus/qcom-ngd-ctrl.c | 122 +++++++++++++-------- drivers/soc/qcom/ice.c | 40 +++++-- drivers/spi/spi-cadence-quadspi.c | 5 +- drivers/tee/optee/supp.c | 107 ++++++++++++------ drivers/tee/tee_shm.c | 2 +- drivers/thunderbolt/property.c | 6 + drivers/thunderbolt/xdomain.c | 14 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 21 ++-- drivers/usb/serial/option.c | 3 + fs/erofs/internal.h | 7 +- fs/erofs/super.c | 3 +- fs/erofs/sysfs.c | 19 +++- fs/erofs/zdata.c | 36 +++--- fs/fcntl.c | 8 +- fs/fs-writeback.c | 101 +++++++++++------ fs/fuse/dev.c | 9 +- fs/iomap/buffered-io.c | 4 - fs/qnx6/dir.c | 8 +- fs/smb/server/oplock.c | 15 ++- fs/smb/server/smb2pdu.c | 11 ++ include/linux/backing-dev-defs.h | 4 + include/linux/hugetlb.h | 8 -- include/linux/ieee80211.h | 18 +-- include/linux/kexec.h | 3 + include/linux/mailbox_controller.h | 3 + include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 -- include/linux/writeback.h | 2 + include/net/act_api.h | 1 + include/net/bluetooth/hci_core.h | 9 +- include/net/bluetooth/hci_sync.h | 4 +- include/net/bluetooth/l2cap.h | 1 + include/net/ip.h | 8 ++ include/net/ip_vs.h | 3 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/secure_seq.h | 45 ++++++-- include/net/sock.h | 1 + include/net/tc_act/tc_pedit.h | 2 +- include/net/tcp.h | 6 +- include/rdma/ib_umem.h | 48 +++----- include/rdma/ib_verbs.h | 48 -------- include/rdma/iter.h | 88 +++++++++++++++ io_uring/io_uring.c | 2 +- io_uring/kbuf.c | 1 - io_uring/net.c | 3 +- ipc/shm.c | 10 +- kernel/dma/debug.c | 2 +- kernel/kexec_file.c | 33 +++++- kernel/pid.c | 8 +- kernel/sched/ext.c | 9 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/time/timer_migration.c | 8 +- kernel/trace/trace_probe.c | 2 - mm/backing-dev.c | 5 + mm/damon/ops-common.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 70 ++++++------ mm/memory-failure.c | 19 ++-- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/bluetooth/bnep/core.c | 50 ++++++--- net/bluetooth/hci_conn.c | 31 ++++-- net/bluetooth/hci_core.c | 16 ++- net/bluetooth/hci_sync.c | 25 ++++- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/iso.c | 71 ++++++++---- net/bluetooth/l2cap_core.c | 46 ++++++++ net/bluetooth/mgmt.c | 17 +-- net/bluetooth/rfcomm/core.c | 69 ++++++++---- net/bluetooth/rfcomm/sock.c | 26 ++++- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 ++- net/bridge/netfilter/ebt_snat.c | 3 + net/core/filter.c | 15 ++- net/core/gro.c | 5 + net/core/netdev-genl.c | 4 +- net/core/secure_seq.c | 80 +++++--------- net/core/skbuff.c | 6 +- net/core/sock.c | 13 ++- net/devlink/core.c | 2 + net/hsr/hsr_framereg.c | 4 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/inet_fragment.c | 3 + net/ipv4/ip_fragment.c | 3 - net/ipv4/ip_options.c | 4 + net/ipv4/netfilter/arp_tables.c | 15 +-- net/ipv4/netfilter/ip_tables.c | 15 +-- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/syncookies.c | 19 ++-- net/ipv4/tcp.c | 44 ++++---- net/ipv4/tcp_fastopen.c | 2 +- net/ipv4/tcp_input.c | 22 ++-- net/ipv4/tcp_ipv4.c | 84 +++++++------- net/ipv4/tcp_minisocks.c | 11 +- net/ipv4/tcp_output.c | 12 +- net/ipv4/tcp_timer.c | 4 +- net/ipv4/udp.c | 8 ++ net/ipv4/xfrm4_input.c | 5 +- net/ipv6/addrconf.c | 6 +- net/ipv6/ip6_vti.c | 2 + net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +-- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/sit.c | 1 + net/ipv6/syncookies.c | 11 +- net/ipv6/tcp_ipv6.c | 37 +++---- net/ipv6/xfrm6_input.c | 5 +- net/l2tp/l2tp_ppp.c | 92 +++++++++------- net/mac80211/tx.c | 4 +- net/mptcp/options.c | 73 ++++++------ net/mptcp/pm.c | 15 +-- net/mptcp/pm_userspace.c | 13 ++- net/mptcp/protocol.c | 10 +- net/mptcp/protocol.h | 7 +- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 ++- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 ++-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 ++-- net/netfilter/ipvs/ip_vs_sched.c | 14 +-- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 +++-- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 24 +++- net/netfilter/nfnetlink_log.c | 23 +++- net/netfilter/nfnetlink_queue.c | 64 +++++++++-- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++--- net/openvswitch/datapath.c | 1 + net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/act_pedit.c | 97 ++++++++-------- net/sctp/diag.c | 17 +-- net/sctp/input.c | 8 ++ net/sctp/sm_statefuns.c | 6 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 17 ++- net/socket.c | 11 +- net/vmw_vsock/virtio_transport_common.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 25 +++-- net/xfrm/xfrm_policy.c | 13 +-- scripts/Makefile.compiler | 2 +- scripts/generate_rust_target.rs | 8 +- security/integrity/ima/ima_kexec.c | 46 +++++--- sound/core/pcm_native.c | 7 +- sound/core/seq/seq_dummy.c | 15 ++- sound/core/timer.c | 17 +-- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/testing/selftests/ptp/testptp.c | 62 +---------- tools/verification/rv/src/in_kernel.c | 2 +- virt/kvm/kvm_main.c | 3 +- 307 files changed, 3040 insertions(+), 1602 deletions(-)

3 months, 2 weeks

[PATCH 6.6 000/452] 6.6.143-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.143 release. There are 452 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.143-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.143-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Call the spectral chicken in the Zen2 init function Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: add-addr: always drop other suboptions Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Jason Gunthorpe <jgg(a)ziepe.ca> RDMA: During rereg_mr ensure that REREG_ACCESS is compatible Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Jane Chu <jane.chu(a)oracle.com> mm/memory-failure: fix missing ->mf_stats count in hugetlb poison David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() David Hildenbrand <david(a)redhat.com> mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function Ricardo B. Marliere <ricardo(a)marliere.net> serdev: make serdev_bus_type const SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: introduce the mptcp_init_skb helper David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> iio: adc: npcm: Convert to platform remove callback returning void Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Jann Horn <jannh(a)google.com> af_unix: Fix UAF read of tail->len in unix_stream_data_wait() Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Cache state->msg in unix_stream_read_generic(). David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Paolo Abeni <pabeni(a)redhat.com> mptcp: use plain bool instead of custom binary enum Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Guopeng Zhang <zhangguopeng(a)kylinos.cn> cgroup/cpuset: Reset DL migration state on can_attach() failure Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Johan Hovold <johan(a)kernel.org> driver core: reject devices with unregistered buses Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Andrew Martin <andrew.martin(a)amd.com> drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Muhammad Bilal <meatuni001(a)gmail.com> drm/amdkfd: fix NULL dereference in get_queue_ids() Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type David Carlier <devnexen(a)gmail.com> mm/hugetlb: restore reservation on error in hugetlb folio copy paths Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Update comments find_equal_scalars->sync_linked_regs Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking Eduard Zingerman <eddyz87(a)gmail.com> bpf: Remove mark_precise_scalar_ids() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Track equal scalars history on per-instruction level Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Andre Heider <a.heider(a)gmail.com> nvmem: layouts: onie-tlv: fix hang on unknown types Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Hyunwoo Kim <imv4bel(a)gmail.com> inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Tao Cui <cuitao(a)kylinos.cn> selftests: mptcp: add test for extra_subflows underflow on userspace PM Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Cunlong Li <shenxiaogll(a)gmail.com> zram: fix use-after-free in zram_bvec_write_partial() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Wentao Liang <vulab(a)iscas.ac.cn> drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Sean Christopherson <seanjc(a)google.com> KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Point the error offset correctly for eprobe argument error Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Fix driver removal with disabled KMS Pengyu Luo <mitltlatltl(a)gmail.com> clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack Ido Schimmel <idosch(a)nvidia.com> ipv6: Fix a potential NPD in cleanup_prefix_route() Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: clean the sfp upstream if phy probing fails Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Yun Zhou <yun.zhou(a)windriver.com> gpio: mvebu: fix NULL pointer dereference in suspend/resume Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Brian Foster <bfoster(a)redhat.com> iomap: don't revert iov_iter on partially completed buffered writes Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Gabriele Monaco <gmonaco(a)redhat.com> tools/rv: Fix cleanup after failed trace setup Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ncm: Fix net_device lifecycle with device_move Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Rui Qi <qirui.001(a)bytedance.com> ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Lorenzo Bianconi <lorenzo(a)kernel.org> net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> hsr: Remove WARN_ONCE() in hsr_addr_is_self(). Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Jiayuan Chen <jiayuan.chen(a)linux.dev> netfilter: nft_ct: bail out on template ct in get eval Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/core) Protect regulator operations with mutex Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Mickaël Salaün <mic(a)digikod.net> landlock: Fix handling of disconnected directories Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Prathamesh Shete <pshete(a)nvidia.com> soc/tegra: pmc: Fix unsafe generic_handle_irq() call Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> x86/kexec: add a sanity check on previous kernel's ima kexec buffer Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> ima: verify the previous kernel's IMA buffer lies in addressable RAM Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Will Deacon <will(a)kernel.org> arm64: io: Extract user memory type in ioremap_prot() Will Deacon <will(a)kernel.org> arm64: io: Rename ioremap_prot() to __ioremap_prot() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Jakub Kicinski <kuba(a)kernel.org> inet: frags: flush pending skbs in fqdir_pre_exit() Jakub Kicinski <kuba(a)kernel.org> inet: frags: add inet_frag_queue_flush() Thomas Zimmermann <tzimmermann(a)suse.de> drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Thomas Zimmermann <tzimmermann(a)suse.de> drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: add support for doing AND, OR and XOR directly Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: rename some boolean operation functions Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 48 +++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/io.h | 25 +- arch/arm64/include/asm/kvm_mmu.h | 5 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 64 ++-- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/cpu_errata.c | 34 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 69 +--- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 21 +- arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/ioremap.c | 8 +- arch/mips/dec/platform.c | 109 +++++- arch/x86/kernel/Makefile | 14 + arch/x86/kernel/cpu/amd.c | 33 +- arch/x86/kernel/setup.c | 6 + arch/x86/kvm/svm/avic.c | 35 +- arch/x86/mm/Makefile | 2 + drivers/auxdisplay/line-display.c | 2 +- drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 +-- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 29 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_fb_helper.c | 12 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 + drivers/gpu/drm/i915/display/intel_psr.c | 34 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 3 +- drivers/hid/hid-core.c | 35 +- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 49 ++- drivers/hwmon/pmbus/pmbus_core.c | 117 +++++-- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/npcm_adc.c | 31 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++-- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++ drivers/infiniband/core/umem.c | 16 + drivers/infiniband/core/verbs.c | 38 --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/keyboard/atkbd.c | 15 + drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/md/bcache/super.c | 3 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/fastrpc.c | 107 +++--- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++-- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 +++- drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/phy/phy_device.c | 6 + drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/of/kexec.c | 15 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 34 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 +- drivers/scsi/scsi_transport_fc.c | 77 +++-- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/soc/qcom/ice.c | 36 +- drivers/soc/tegra/pmc.c | 104 ++++-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/tee/optee/supp.c | 107 ++++-- drivers/thunderbolt/property.c | 38 ++- drivers/thunderbolt/xdomain.c | 14 +- drivers/tty/serdev/core.c | 23 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++----- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 17 +- drivers/tty/serial/samsung_tty.c | 129 ++++--- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 + drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_ncm.c | 33 +- drivers/usb/gadget/function/f_uvc.c | 26 +- drivers/usb/gadget/function/u_ether.c | 28 +- drivers/usb/gadget/function/u_ether.h | 26 ++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++-- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/video/fbdev/Kconfig | 1 + drivers/video/fbdev/core/fbcon.c | 9 + drivers/video/fbdev/vt8500lcdfb.c | 4 +- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hpfs/alloc.c | 2 +- fs/iomap/buffered-io.c | 4 - fs/smb/client/netlink.c | 6 +- fs/smb/server/oplock.c | 15 +- fs/smb/server/smb2pdu.c | 143 ++++++-- fs/smb/server/smbacl.c | 51 ++- fs/smb/server/smbacl.h | 2 + include/drm/display/drm_dp.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/bpf_verifier.h | 4 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 15 +- include/linux/hid_bpf.h | 4 +- include/linux/hugetlb.h | 16 +- include/linux/ima.h | 1 + include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 - include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/inet_frag.h | 18 +- include/net/ip_vs.h | 3 +- include/net/ipv6_frag.h | 9 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/netfilter/nf_tables.h | 7 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 44 +-- include/rdma/ib_verbs.h | 48 --- include/rdma/iter.h | 88 +++++ include/uapi/linux/netfilter/nf_tables.h | 18 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/bpf/verifier.c | 369 +++++++++++++-------- kernel/cgroup/cpuset.c | 8 +- kernel/events/core.c | 16 +- kernel/pid.c | 8 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 2 - lib/debugobjects.c | 2 +- mm/damon/ops-common.c | 4 +- mm/damon/sysfs-schemes.c | 8 +- mm/gup.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 118 ++++--- mm/memfd.c | 12 +- mm/memory-failure.c | 94 +++--- mm/memory.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 18 +- mm/page_alloc.c | 1 + net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/batman-adv/bat_iv_ogm.c | 82 ++++- net/batman-adv/bat_v_ogm.c | 59 ++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 ++-- net/batman-adv/translation-table.c | 43 ++- net/batman-adv/tvlv.c | 28 +- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 ++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/bnep/core.c | 50 ++- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_sync.c | 9 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 87 ++++- net/bluetooth/l2cap_sock.c | 16 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 ++-- net/bluetooth/rfcomm/sock.c | 26 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++ net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 20 +- net/core/sock.c | 13 +- net/ethtool/eeprom.c | 10 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 10 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 54 ++- net/ipv4/ip_fragment.c | 21 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/addrconf.c | 53 +-- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 35 +- net/ipv6/ioam6.c | 8 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 +- net/ipv6/mcast.c | 22 +- net/ipv6/ndisc.c | 18 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 5 + net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 58 ++-- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/options.c | 73 ++-- net/mptcp/pm.c | 49 ++- net/mptcp/pm_netlink.c | 18 +- net/mptcp/protocol.c | 102 ++++-- net/mptcp/protocol.h | 17 +- net/mptcp/sockopt.c | 8 +- net/mptcp/subflow.c | 20 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 26 +- net/netfilter/nft_bitwise.c | 184 ++++++++-- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++- net/rxrpc/rxkad.c | 115 +++---- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 --- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 21 +- net/socket.c | 11 +- net/unix/af_unix.c | 38 +-- net/vmw_vsock/af_vsock.c | 49 ++- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 12 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/integrity/ima/ima_kexec.c | 35 ++ security/landlock/errata/abi-1.h | 16 + security/landlock/fs.c | 40 ++- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + .../motu/motu-register-dsp-message-parser.c | 14 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +-- .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++++++++++------- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 2 +- .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 +++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/testing/selftests/ptp/testptp.c | 62 +--- tools/verification/rv/src/in_kernel.c | 2 +- virt/kvm/kvm_main.c | 3 +- 508 files changed, 5864 insertions(+), 3002 deletions(-)

3 months, 2 weeks

[PATCH 6.1 000/522] 6.1.176-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.176 release. There are 522 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.176-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.176-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/v3d: Reject empty multisync extension to prevent infinite loop SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Arnaldo Carvalho de Melo <acme(a)redhat.com> perf build: Remove -Wno-unused-but-set-variable from the flex flags when building with clang < 13.0.0 Arnaldo Carvalho de Melo <acme(a)redhat.com> tools build: Add 3-component logical version comparators Ian Rogers <irogers(a)google.com> perf build: Disable fewer bison warnings Ian Rogers <irogers(a)google.com> perf parse-events: Make YYDEBUG dependent on doing a debug build Ian Rogers <irogers(a)google.com> perf build: Conditionally define NDEBUG Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Wupeng Ma <mawupeng1(a)huawei.com> mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Jane Chu <jane.chu(a)oracle.com> mm/memory-failure: fix missing ->mf_stats count in hugetlb poison David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() David Hildenbrand <david(a)redhat.com> mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio David Hildenbrand <david(a)redhat.com> mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> iio: adc: npcm: Convert to platform remove callback returning void Ruan Jinjie <ruanjinjie(a)huawei.com> iio: adc: fix the return value handle for platform_get_irq() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Create wrapper to walk PCI config space David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Add private data for per-device data Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Guopeng Zhang <zhangguopeng(a)kylinos.cn> cgroup/cpuset: Reset DL migration state on can_attach() failure Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: st-ssc4: switch to use modern name Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Li Zetao <lizetao1(a)huawei.com> spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: microchip-core-qspi: Convert to platform remove callback returning void Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: uniphier: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: uniphier: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Zeng Heng <zengheng4(a)huawei.com> mtd: spi-nor: core: fix implicit declaration warning Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Andi Shyti <andi.shyti(a)kernel.org> spi: s3c64xx: Use devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: zynq-qspi: switch to use modern name Ruan Jinjie <ruanjinjie(a)huawei.com> spi: spi-zynq: Do not check for 0 return after calling platform_get_irq() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: zynq-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: spi-ti-qspi: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> spi: Convert to SPI_CONTROLLER_HALF_DUPLEX Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun4i: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: sun4i: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: synquacer: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: synquacer: Convert to platform remove callback returning void Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: imx: Convert to platform remove callback returning void Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Jiazi Li <jqqlijiazi(a)gmail.com> f2fs: use kfree() instead of kvfree() to free some memory Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Lorenzo Stoakes <ljs(a)kernel.org> mm/hugetlb: avoid false positive lockdep assertion Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Christian König <christian.koenig(a)amd.com> drm/amdgpu: restart the CS if some parts of the VM are still invalidated Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: fix OF node refcount Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Validate XDomain request packet size before type cast Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Set mandatory idle clocks before CMD0 Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-af: fix memory leak in rvu_setup_hw_resources() Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Nikolay Kuratov <kniv(a)yandex-team.ru> net/mlx5: Reorder completion before putting command entry in cmd_work_handler Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Zhenghang Xiao <kipreyyy(a)gmail.com> misc: fastrpc: fix use-after-free race in fastrpc_map_create Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuqi Xu <xuyuqiabc(a)gmail.com> wifi: nl80211: reject oversized EMA RNR lists Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: allow subflow rcv wnd to shrink Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Sechang Lim <rhkrqnwk98(a)gmail.com> udp: clear skb->dev before running a sockmap verdict Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Inochi Amaoto <inochiama(a)gmail.com> mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Yuqi Xu <xuyq21(a)lenovo.com> Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack: destroy stale expectfn expectations on unregister Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: handle the return value of usb_reset_device() Douglas Anderson <dianders(a)chromium.org> r8152: Block future register access if register access fails Hayes Wang <hayeswang(a)realtek.com> r8152: reduce the control transfer of rtl8152_get_version() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Yao Sang <sangyao(a)kylinos.cn> net/mlx4: avoid GCC 10 __bad_copy_from() false positive Eric Dumazet <edumazet(a)google.com> tcp: restrict SO_ATTACH_FILTER to priv users Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: wm_adsp: Fix NULL dereference when removing firmware controls Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Brian Foster <bfoster(a)redhat.com> iomap: don't revert iov_iter on partially completed buffered writes Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ncm: Fix net_device lifecycle with device_move Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Rui Qi <qirui.001(a)bytedance.com> ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: fix spurious notification on VNI update Andy Roulin <aroulin(a)nvidia.com> vxlan: vnifilter: send notification on VNI add Nithin Dabilpuram <ndabilpuram(a)marvell.com> octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Kurt Kanzenbach <kurt(a)linutronix.de> ptp: vclock: Switch from RCU to SRCU Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() Tapio Reijonen <tapio.reijonen(a)vaisala.com> net: fec: fix pinctrl default state restore order on resume David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Kuniyuki Iwashima <kuniyu(a)google.com> net: Annotate sk->sk_write_space() for UDP SOCKMAP. Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Nicolò Coccia <n.coccia96(a)gmail.com> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Jiayuan Chen <jiayuan.chen(a)shopee.com> bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restore set elements when delete set fails Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Vladislav Nikolaev <vlad102nikolaev(a)gmail.com> RDMA/rxe: Complete the rxe_cleanup_task backport Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Sabrina Dubroca <sd(a)queasysnail.net> net: gro: don't merge zcopy skbs Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Eric Dumazet <edumazet(a)google.com> net/packet: convert po->running to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->has_vnet_hdr to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->tp_loss to an atomic flag Eric Dumazet <edumazet(a)google.com> net/packet: convert po->tp_tx_has_off to an atomic flag Martin KaFai Lau <martin.lau(a)kernel.org> selftests/bpf: S/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: enhance align selftest's expected log matching Stanislav Fomichev <sdf(a)google.com> selftests/bpf: Update bpf_clone_redirect expected return code Yonghong Song <yonghong.song(a)linux.dev> bpf: Fix a few selftest failures due to llvm18 change Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add read_build_id function Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()" Paul Chaignon <paul.chaignon(a)gmail.com> Revert "selftests/bpf: Workaround strict bpf_lsm return value check." Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: Convert test_global_funcs test to test_loader framework Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: add generic BPF program tester-loader Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tools/bootconfig: Cleanup bootconfig footer size calculations Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 52 +++-- arch/arm64/kernel/cpu_errata.c | 34 ++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +--- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +- arch/arm64/mm/mmu.c | 36 ++-- arch/loongarch/kernel/syscall.c | 3 +- arch/x86/kernel/cpu/amd.c | 18 +- block/blk-cgroup.c | 32 +-- drivers/auxdisplay/line-display.c | 2 +- drivers/base/power/domain.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 42 ++-- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++-- drivers/crypto/nx/nx-842.h | 24 ++- drivers/crypto/nx/nx-common-powernv.c | 31 ++- drivers/crypto/nx/nx-common-pseries.c | 33 ++- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 +++-- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++++-- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 ++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 5 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 33 ++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 56 ++++- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/bcm_iproc_adc.c | 4 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/npcm_adc.c | 31 +-- drivers/iio/adc/spear_adc.c | 4 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 +++--- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 ++++ drivers/infiniband/core/verbs.c | 38 ---- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 4 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 ++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 102 +++++---- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/core.c | 1 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/bonding/bond_main.c | 19 +- drivers/net/bonding/bond_options.c | 2 + drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 ++++--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +-- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/microchip/lan743x_main.c | 32 +++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++++--- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +--- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/usb/r8152.c | 211 ++++++++++++++++--- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireguard/send.c | 20 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 17 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++- drivers/phy/tegra/xusb.h | 1 + drivers/platform/x86/intel/vsec.c | 77 +++++-- drivers/platform/x86/intel/vsec.h | 2 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_fc.c | 77 +++---- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/spi/spi-amd.c | 2 +- drivers/spi/spi-cavium-thunderx.c | 2 +- drivers/spi/spi-falcon.c | 2 +- drivers/spi/spi-imx.c | 8 +- drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-lp8841-rtc.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 47 ++--- drivers/spi/spi-mxs.c | 2 +- drivers/spi/spi-omap-uwire.c | 2 +- drivers/spi/spi-pic32-sqi.c | 2 +- drivers/spi/spi-qcom-qspi.c | 2 +- drivers/spi/spi-qup.c | 169 +++++++-------- drivers/spi/spi-rockchip-sfc.c | 2 +- drivers/spi/spi-s3c64xx.c | 44 +--- drivers/spi/spi-sprd-adi.c | 2 +- drivers/spi/spi-st-ssc4.c | 76 +++---- drivers/spi/spi-sun4i.c | 84 ++++---- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 92 ++++---- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 97 +++++---- drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-uniphier.c | 216 ++++++++++--------- drivers/spi/spi-xcomm.c | 2 +- drivers/spi/spi-zynq-qspi.c | 89 +++----- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 61 +++--- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/tee/optee/supp.c | 107 +++++++--- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++- drivers/thunderbolt/xdomain.c | 14 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 57 ++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 75 +++---- drivers/tty/serial/samsung_tty.c | 130 ++++++------ drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++-- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +- drivers/usb/gadget/function/f_ncm.c | 33 ++- drivers/usb/gadget/function/u_ether.c | 28 ++- drivers/usb/gadget/function/u_ether.h | 26 +++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 ++++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/video/fbdev/core/fb_defio.c | 164 +++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/node.c | 4 +- fs/f2fs/segment.c | 10 +- fs/f2fs/super.c | 29 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hfsplus/bfind.c | 51 +++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/iomap/buffered-io.c | 4 - fs/ntfs3/xattr.c | 1 + fs/smb/client/cifsacl.c | 128 +++++++++-- fs/smb/client/ioctl.c | 2 +- fs/smb/client/netlink.c | 6 +- fs/smb/client/smb2transport.c | 32 ++- fs/smb/server/smb2pdu.c | 11 + fs/smb/server/smbacl.c | 17 +- fs/udf/super.c | 4 +- fs/xfs/xfs_buf.c | 1 + include/drm/display/drm_dp.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/damon.h | 2 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/hugetlb.h | 14 +- include/linux/mm.h | 5 - include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/syscalls.h | 4 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/bonding.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +--- include/rdma/ib_verbs.h | 48 ----- include/rdma/iter.h | 88 ++++++++ ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/cgroup/cpuset.c | 8 +- kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- lib/test_hmm.c | 86 ++++---- mm/damon/core.c | 37 +++- mm/damon/lru_sort.c | 84 +++++--- mm/damon/ops-common.c | 4 +- mm/damon/reclaim.c | 84 +++++--- mm/gup.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 113 +++++++--- mm/memory-failure.c | 92 ++++---- mm/memory.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 18 +- mm/page_alloc.c | 1 + net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/batman-adv/bat_iv_ogm.c | 82 ++++++-- net/batman-adv/bat_v_ogm.c | 59 +++--- net/batman-adv/bridge_loop_avoidance.c | 57 +++-- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 109 +++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 43 +++- net/batman-adv/tvlv.c | 28 ++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 46 +++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/af_bluetooth.c | 113 ++++++++-- net/bluetooth/bnep/core.c | 50 +++-- net/bluetooth/hci_sync.c | 5 + net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 87 +++++++- net/bluetooth/l2cap_sock.c | 35 +--- net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 ++++-- net/bluetooth/rfcomm/sock.c | 26 ++- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 +++ net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/gro.c | 3 + net/core/skbuff.c | 20 +- net/core/sock.c | 13 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 +-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/ah6.c | 29 ++- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 21 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 8 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 5 + net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/mac80211/mlme.c | 4 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 43 ++-- net/mptcp/pm.c | 34 ++- net/mptcp/pm_netlink.c | 45 ++-- net/mptcp/protocol.c | 29 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 ++- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nf_tables_api.c | 41 +++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_set_bitmap.c | 4 +- net/netfilter/nft_set_hash.c | 8 +- net/netfilter/nft_set_pipapo.c | 5 +- net/netfilter/nft_set_rbtree.c | 4 +- net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 74 ++++--- net/packet/diag.c | 6 +- net/packet/internal.h | 8 +- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++---------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ---- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 21 +- net/socket.c | 11 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 +++- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 +-- sound/aoa/codecs/onyx.c | 104 +++------ sound/aoa/codecs/tas.c | 113 ++++------ sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +-- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++------- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + .../motu/motu-register-dsp-message-parser.c | 14 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- tools/bootconfig/main.c | 23 +- tools/perf/Makefile.config | 1 + tools/perf/util/Build | 32 ++- tools/perf/util/expr.y | 4 +- tools/perf/util/parse-events.y | 3 + tools/perf/util/pmu.y | 3 + tools/scripts/utilities.mak | 20 ++ tools/testing/selftests/bpf/DENYLIST.s390x | 1 - tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/align.c | 18 +- tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 6 +- tools/testing/selftests/bpf/prog_tests/empty_skb.c | 12 +- .../bpf/prog_tests/libbpf_get_fd_by_id_opts.c | 87 -------- .../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 73 ------- .../selftests/bpf/prog_tests/test_global_funcs.c | 131 +++--------- .../selftests/bpf/prog_tests/xdp_synproxy.c | 6 +- tools/testing/selftests/bpf/progs/bpf_misc.h | 5 + .../selftests/bpf/progs/test_global_func1.c | 6 +- .../selftests/bpf/progs/test_global_func10.c | 1 + .../selftests/bpf/progs/test_global_func11.c | 4 +- .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_global_func13.c | 4 +- .../selftests/bpf/progs/test_global_func14.c | 4 +- .../selftests/bpf/progs/test_global_func15.c | 4 +- .../selftests/bpf/progs/test_global_func16.c | 4 +- .../selftests/bpf/progs/test_global_func17.c | 5 +- .../selftests/bpf/progs/test_global_func2.c | 43 +++- .../selftests/bpf/progs/test_global_func3.c | 10 +- .../selftests/bpf/progs/test_global_func4.c | 55 ++++- .../selftests/bpf/progs/test_global_func5.c | 4 +- .../selftests/bpf/progs/test_global_func6.c | 4 +- .../selftests/bpf/progs/test_global_func7.c | 4 +- .../selftests/bpf/progs/test_global_func8.c | 4 +- .../selftests/bpf/progs/test_global_func9.c | 4 +- .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 37 ---- .../selftests/bpf/progs/test_ns_current_pid_tgid.c | 7 - tools/testing/selftests/bpf/test_loader.c | 233 +++++++++++++++++++++ tools/testing/selftests/bpf/test_progs.h | 33 +++ tools/testing/selftests/bpf/trace_helpers.c | 82 ++++++++ tools/testing/selftests/bpf/trace_helpers.h | 5 + tools/testing/selftests/bpf/verifier/int_ptr.c | 6 +- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/ptp/testptp.c | 62 +----- tools/testing/selftests/vm/hmm-tests.c | 50 +++++ 543 files changed, 6595 insertions(+), 3687 deletions(-)

3 months, 2 weeks

[PATCH 5.15 000/410] 5.15.210-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.210 release. There are 410 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 19 Jun 2026 08:02:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.210-rc2 Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix backward compatibility with userspace Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Christian Göttsche <cgzones(a)googlemail.com> selinux: enable genfscon labeling for securityfs Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Eric Biggers <ebiggers(a)kernel.org> ksmbd: Compare MACs in constant time Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Michael Kelley <mikelley(a)microsoft.com> drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Jimmy Hon <honyuenkwun(a)gmail.com> rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Duoming Zhou <duoming(a)zju.edu.cn> wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 19 ++- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 118 ++++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 49 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 21 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 480 files changed, 4805 insertions(+), 2544 deletions(-)

3 months, 2 weeks

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage June 2026