Lkft-triage June 2026

lkft-triage@lists.linaro.org

33 participants
20 discussions

[PATCH 5.15 000/411] 5.15.210-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.210 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.210-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Christian Göttsche <cgzones(a)googlemail.com> selinux: enable genfscon labeling for securityfs Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Eric Biggers <ebiggers(a)kernel.org> ksmbd: Compare MACs in constant time Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Michael Kelley <mikelley(a)microsoft.com> drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Christoph Hellwig <hch(a)lst.de> sd: rename the scsi_disk.dev field Luis Chamberlain <mcgrof(a)kernel.org> scsi: sd: Add error handling support for add_disk() Bart Van Assche <bvanassche(a)acm.org> scsi: core: pm: Rely on the device driver core for async power management Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Tom Yan <tom.ty89(a)gmail.com> nvme: fix interpretation of DMRSL Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Jimmy Hon <honyuenkwun(a)gmail.com> rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Duoming Zhou <duoming(a)zju.edu.cn> wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 17 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/hosts.c | 1 + drivers/scsi/scsi.c | 8 - drivers/scsi/scsi_pm.c | 44 +---- drivers/scsi/scsi_priv.h | 4 +- drivers/scsi/scsi_scan.c | 17 ++ drivers/scsi/scsi_sysfs.c | 1 + drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sd.c | 30 ++-- drivers/scsi/sd.h | 9 +- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 109 +++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 46 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 20 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ----- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 491 files changed, 4845 insertions(+), 2652 deletions(-)

4 days, 13 hours

Project Takeoffs

by Donald Marvin

Hi, It comes from City Estimating, LLC We specialize in full cost estimates and all related bidding services for all construction projects in all 50 states. We provide our services to both general and subcontractors, as well as owners/developers, architects and engineers. Feel free to contact me if you have any question or want to see our sample work. Regards, Donald Marvin Marketing Executive City Estimating, LLC

6 days, 3 hours

地方で儲かる、焼肉ビジネス

by 小山｜ときわ亭セミナー窓口

新たな事業をお考えの経営者様へ　　　いつもお世話になります。　　TBSテレビ『坂上＆指原のつぶれない店』で取り上げられるなど、　今話題の、待ち時間0秒の飲み放題を提供する　焼肉酒場「ときわ亭」のフランチャイズ説明会をご案内いたします。　　　わずか2年半で全国80店舗展開した　「0秒レモンサワー　ときわ亭」の　　ビジネスモデル、収益性や最新の飲食市場実態を　オンラインによる説明会形式で分かりやすく、丁寧にお伝えします。　　※本セミナー参加、店舗オープンの場合　　研修費用50万円を本部支援！　　　このような方におススメ　・銀行融資を受けやすくなるコツをしりたい　・飲食店の経営に興味がある　・焼肉屋の経営実態がしりたい　こういった方は、ぜひお気軽にご視聴くださいませ。　　　▼　オンライン説明会のご視聴予約はこちら　▼ 　　　https://tokiwatei-fc.work/web/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━ 　■　ご説明するフランチャイズシステム　　0秒レモンサワー　仙台ホルモン焼肉酒場ときわ亭　■　開催日程　・6月25日（木）15:00〜16:30　残り2枠　＠オンライン開催　　■　定員　・先着10社　　■　参加費　・不要 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 本メールが不要の方には大変失礼しました。今後ご案内が不要な際は、下記URLにて配信解除を承っています。 https://tokiwatei-fc.work/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 主催：GOSSO株式会社（ときわ亭フランチャイズ本部）東京都渋谷区宇田川町14-13 宇田川ビルディング6F 03-6316-8191　 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1 week, 1 day

[PATCH 6.12 000/307] 6.12.93-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.93 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:47 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.93-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.93-rc1 Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Liu Ye <liuye(a)kylinos.cn> mm/memfd: fix spelling and grammatical issues Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: perform all memfd seal checks in a single place Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Ingo Molnar <mingo(a)kernel.org> x86/alternatives: Rename 'apply_relocation()' to 'text_poke_apply_relocation()' Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently Paolo Abeni <pabeni(a)redhat.com> mptcp: introduce the mptcp_init_skb helper Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Flush and stop persistent ring buffer on panic Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: scarlett2: Allow flash writes ending at segment boundary Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Brian Gerst <brgerst(a)gmail.com> x86/boot: Disable stack protector for early boot code Tushar Dave <tdave(a)nvidia.com> iommu: Skip PASID validation for devices without PASID capability Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Will Deacon <will(a)kernel.org> arm64: io: Extract user memory type in ioremap_prot() Will Deacon <will(a)kernel.org> arm64: io: Rename ioremap_prot() to __ioremap_prot() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Jakub Kicinski <kuba(a)kernel.org> inet: frags: flush pending skbs in fqdir_pre_exit() Jakub Kicinski <kuba(a)kernel.org> inet: frags: add inet_frag_queue_flush() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Al Viro <viro(a)zeniv.linux.org.uk> remove pointless includes of <linux/fdtable.h> Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Eric Dumazet <edumazet(a)google.com> net/sched: act_mirred: add loop detection Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net/sched: act_mirred: Move the recursion counter struct netdev_xmit Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add support for writing firmware blocks using EPL payload Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add new parameters and a function to support EPL Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: always unmask interrupts in el0_softstp() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove debug exception registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split bkpt32 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split brk64 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware watchpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split single stepping exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: refactor reinstall_suspended_bps() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware breakpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: entry: Add entry and exit functions for debug exceptions Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove break/step handler registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call step handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call software breakpoint handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: refactor aarch32_break_handler() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: clean up single_step_handler logic Mostafa Saleh <smostafa(a)google.com> arm64: Introduce esr_is_ubsan_brk() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Release indirect CSD GEM reference on CPU job free Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix use-after-free of CPU job query arrays on error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/alpha/include/asm/Kbuild | 1 + arch/arc/include/asm/Kbuild | 1 + arch/arm/include/asm/Kbuild | 1 + arch/arm64/include/asm/debug-monitors.h | 34 +-- arch/arm64/include/asm/esr.h | 5 + arch/arm64/include/asm/exception.h | 14 +- arch/arm64/include/asm/io.h | 24 +- arch/arm64/include/asm/kgdb.h | 12 + arch/arm64/include/asm/kprobes.h | 8 + arch/arm64/include/asm/ring_buffer.h | 10 + arch/arm64/include/asm/system_misc.h | 4 - arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/traps.h | 6 + arch/arm64/include/asm/uprobes.h | 11 + arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 258 ++++++++------------- arch/arm64/kernel/entry-common.c | 148 +++++++++++- arch/arm64/kernel/hw_breakpoint.c | 60 ++--- arch/arm64/kernel/kgdb.c | 39 +--- arch/arm64/kernel/probes/kprobes.c | 31 +-- arch/arm64/kernel/probes/kprobes_trampoline.S | 2 +- arch/arm64/kernel/probes/uprobes.c | 24 +- arch/arm64/kernel/traps.c | 80 +------ arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/fault.c | 75 ------ arch/arm64/mm/ioremap.c | 7 +- arch/csky/include/asm/Kbuild | 1 + arch/hexagon/include/asm/Kbuild | 1 + arch/loongarch/include/asm/Kbuild | 1 + arch/m68k/include/asm/Kbuild | 1 + arch/microblaze/include/asm/Kbuild | 1 + arch/mips/dec/platform.c | 109 ++++++++- arch/mips/include/asm/Kbuild | 1 + arch/nios2/include/asm/Kbuild | 1 + arch/openrisc/include/asm/Kbuild | 1 + arch/parisc/include/asm/Kbuild | 1 + arch/powerpc/include/asm/Kbuild | 1 + arch/riscv/include/asm/Kbuild | 1 + arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/s390/include/asm/Kbuild | 1 + arch/sh/include/asm/Kbuild | 1 + arch/sparc/include/asm/Kbuild | 1 + arch/um/include/asm/Kbuild | 1 + arch/x86/include/asm/Kbuild | 1 + arch/x86/include/asm/text-patching.h | 2 +- arch/x86/kernel/Makefile | 16 ++ arch/x86/kernel/alternative.c | 6 +- arch/x86/kernel/callthunks.c | 6 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 ++- arch/x86/kvm/svm/sev.c | 68 ++++-- arch/x86/mm/Makefile | 2 + arch/xtensa/include/asm/Kbuild | 1 + drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 ++- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++-- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 ++- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 ++- drivers/gpu/drm/v3d/v3d_sched.c | 16 +- drivers/gpu/drm/v3d/v3d_submit.c | 22 +- drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-core.c | 62 ++++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 54 ++++- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 +++--- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/iommu/iommu.c | 25 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 +++--- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 36 +-- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 +++--- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++++------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++++---------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 ++- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 5 + drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++---- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/fcntl.c | 1 - fs/file_table.c | 1 - fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 5 - fs/notify/fanotify/fanotify.c | 1 - fs/notify/fanotify/fanotify_user.c | 1 - fs/overlayfs/copy_up.c | 1 - fs/proc/base.c | 1 - fs/smb/server/smbacl.c | 8 +- include/asm-generic/ring_buffer.h | 13 ++ include/drm/display/drm_dp.h | 1 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 17 +- include/linux/hid_bpf.h | 14 +- include/linux/memfd.h | 23 +- include/linux/mm.h | 55 ----- include/linux/netdevice_xmit.h | 10 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/inet_frag.h | 18 +- include/net/ipv6_frag.h | 9 +- include/net/xfrm.h | 3 +- io_uring/io_uring.c | 1 - ipc/util.c | 2 +- kernel/bpf/bpf_inode_storage.c | 1 - kernel/bpf/bpf_task_storage.c | 1 - kernel/bpf/token.c | 1 - kernel/events/core.c | 16 +- kernel/exit.c | 1 - kernel/fork.c | 11 +- kernel/module/dups.c | 1 - kernel/module/kmod.c | 1 - kernel/trace/ring_buffer.c | 22 ++ kernel/umh.c | 1 - lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memfd.c | 56 ++++- mm/memory.c | 2 +- mm/mmap.c | 12 +- mm/page_alloc.c | 1 + mm/shmem.c | 6 - net/batman-adv/bat_iv_ogm.c | 82 +++++-- net/batman-adv/bat_v_ogm.c | 59 +++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++-- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 +++--- net/batman-adv/translation-table.c | 57 ++++- net/batman-adv/tvlv.c | 28 ++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 +++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_sync.c | 12 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 +++- net/ethtool/cmis.h | 20 +- net/ethtool/cmis_cdb.c | 103 ++++++-- net/ethtool/cmis_fw_update.c | 214 ++++++++++++----- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 26 +-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 3 +- net/ethtool/strset.c | 2 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 22 +- net/handshake/request.c | 64 +++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 6 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 51 +++- net/ipv4/ip_fragment.c | 18 +- net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 +- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/pm.c | 40 +++- net/mptcp/pm_netlink.c | 16 +- net/mptcp/protocol.c | 92 +++++--- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +-- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 ++++-- net/rxrpc/rxkad.c | 115 ++++----- net/sched/act_mirred.c | 77 ++++-- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 47 +--- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 ++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/apparmor/domain.c | 1 - sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 14 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 38 ++- tools/testing/cxl/test/cxl.c | 105 ++++----- tools/testing/selftests/mm/hmm-tests.c | 50 ++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 382 files changed, 3974 insertions(+), 2279 deletions(-)

1 week, 5 days

[PATCH 7.0 000/332] 7.0.12-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.12 release. There are 332 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.12-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.12-rc1 Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Saurav Sachidanand <sauravsc(a)amazon.com> i2c: tegra: make tegra_i2c_mutex_unlock() return void Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X Fernando Antunez Antonio <fer.antunez24antonio(a)gmail.com> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Lorenzo Stoakes <ljs(a)kernel.org> Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix amdgpu_hmm_range_get_pages Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Pranay Samala <pranay.samala(a)intel.com> drm/i915/color: Fix HDR pre-CSC LUT programming loop Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Guangshuo Li <lgs201920130244(a)gmail.com> uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hang Cao <caohang(a)eswincomputing.com> dt-bindings: usb: Fix EIC7700 USB reset's issue Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir David Carlier <devnexen(a)gmail.com> dma-buf: fix UAF in dma_buf_fd() tracepoint Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Michael Bommarito <michael.bommarito(a)gmail.com> octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Shuvam Pandey <shuvampandey1(a)gmail.com> iio: adc: nxp-sar-adc: zero-initialize dma_slave_config Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: nxp-sar-adc: Avoid division by zero Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: nxp-sar-adc: fix division by zero in write_raw Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix lockdep false positive by removing unneeded lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix deadlock on shared proxy's parent removal Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: undo the vote of the proxy on GPIO free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Richard Chang <richardycc(a)google.com> zram: fix use-after-free in zram_writeback_endio Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Sunny Patel <nueralspacetech(a)gmail.com> mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: do not trigger BUG() on BH disabled context Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Fernando Fernandez Mancera <fmancera(a)suse.de> Revert "ipv6: preserve insertion order for same-scope addresses" Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Frank Wunderlich <frank-w(a)public-files.de> net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work Ivan Vecera <ivecera(a)redhat.com> dpll: export __dpll_device_change_ntf() for use under dpll_lock Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: add die temperature reporting for supported chips Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: detect DPLL channel count from chip ID at runtime Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Kito Xu (veritas501) <hxzene(a)gmail.com> net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Michał Grzelak <michal.grzelak(a)intel.com> drm/i915/aux: use polling when irqs are unavailable Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Fix system name string leaks Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Ewan D. Milne <emilne(a)redhat.com> scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable e521588 <alessandro.schino(a)sbb.ch> esp: fix page frag reference leak on skb_to_sgvec failure Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Fix ACPI GPE handler leak during removal Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: .../devicetree/bindings/usb/eswin,eic7700-usb.yaml | 7 +- Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- block/blk-mq.c | 2 +- drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/acpi/acpica/evxfgpe.c | 50 ++++- drivers/acpi/button.c | 24 ++- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/block/zram/zram_drv.c | 6 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/dma-buf/dma-buf.c | 6 +- drivers/dpll/dpll_netlink.c | 13 +- drivers/dpll/zl3073x/core.c | 116 +++-------- drivers/dpll/zl3073x/core.h | 59 +++--- drivers/dpll/zl3073x/dpll.c | 52 +++-- drivers/dpll/zl3073x/dpll.h | 4 +- drivers/dpll/zl3073x/i2c.c | 37 ++-- drivers/dpll/zl3073x/regs.h | 2 + drivers/dpll/zl3073x/spi.c | 37 ++-- drivers/gpib/cb7210/cb7210.c | 10 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-shared-proxy.c | 9 + drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpio/gpiolib-shared.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_color.c | 2 +- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dp_aux.c | 20 +- drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 69 +++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/i2c/busses/i2c-tegra.c | 15 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/nxp-sar-adc.c | 24 ++- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/rc/igorplugusb.c | 2 +- drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 6 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_rep.c | 8 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/pcs/pcs-mtk-lynxi.c | 3 + drivers/net/phy/micrel.c | 15 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_debug.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/uio/uio_pci_generic_sva.c | 7 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 75 ++++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 46 ++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/acpi/acpixf.h | 5 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/dpll.h | 1 + include/linux/hid.h | 2 - include/linux/hugetlb.h | 8 +- include/linux/hugetlb_inline.h | 12 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/hugetlb.c | 75 +++---- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/migrate_device.c | 4 +- mm/rmap.c | 2 + mm/vmalloc.c | 2 +- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 10 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 29 ++- net/handshake/request.c | 81 ++++++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 16 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 16 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 7 +- net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 5 +- net/rxrpc/rxgk.c | 98 +++------ net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 92 +-------- net/rxrpc/rxkad.c | 29 +-- net/sched/act_mirred.c | 77 +++++--- net/sched/sch_netem.c | 47 +---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 28 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 12 +- sound/hda/codecs/side-codecs/cs35l56_hda.c | 17 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/ioam6.sh | 2 +- 316 files changed, 3289 insertions(+), 1907 deletions(-)

1 week, 6 days

[PATCH 6.18 000/315] 6.18.35-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.35 release. There are 315 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.35-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Qing Wang <wangqing7171(a)gmail.com> mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: borrow forward memory from subflow Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently David Carlier <devnexen(a)gmail.com> net: devmem: reject dma-buf bind with non-page-aligned size or SG length Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Tom Lendacky <thomas.lendacky(a)amd.com> x86/mm: Disable broadcast TLB flush when PCID is disabled Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Weiming Shi <bestswngs(a)gmail.com> net: team: fix NULL pointer dereference in team_xmit during mode change Marc Harvey <marcharvey(a)google.com> net: team: Rename port_disabled team mode op to port_tx_disabled Marc Harvey <marcharvey(a)google.com> net: team: Remove unused team_mode_op, port_enabled Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/cpu/cpuid-deps.c | 1 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 42 ++-- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/cpufreq/intel_pstate.c | 13 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 60 ++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/phy/micrel.c | 15 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +-- drivers/net/team/team_core.c | 51 +++-- drivers/net/team/team_mode_loadbalance.c | 4 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/staging/gpib/cb7210/cb7210.c | 10 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 ++++---- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/smb/client/cifsacl.c | 116 ++++++++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/hid.h | 2 - include/linux/if_team.h | 3 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/rmap.c | 2 + mm/slab_common.c | 2 + mm/slub.c | 1 + net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/devmem.c | 11 ++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 4 +- net/handshake/netlink.c | 6 +- net/handshake/request.c | 16 +- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/fastopen.c | 4 +- net/mptcp/mib.c | 1 - net/mptcp/mib.h | 1 - net/mptcp/protocol.c | 65 ++++-- net/mptcp/protocol.h | 31 ++- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 14 +- net/rxrpc/call_event.c | 22 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++++-- net/rxrpc/rxgk.c | 147 ++++++-------- net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 66 +++---- net/rxrpc/rxkad.c | 115 ++++------- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 29 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 346 files changed, 3284 insertions(+), 1733 deletions(-)

2 weeks

1人で始める、年商1億円ビジネス

by 石嶋紗季

　新規事業をお探しの経営者様・事業オーナー様へ　〜仕入れた瞬間に利益が確定する　　ユニークなビジネスモデルをご存じでしょうか〜　買取大吉だけの買取システムをご紹介する　30分セミナーのご案内です。　　　この事業は、今いる社員1人で、1日5人の来店なのに　売上1億超を狙えます。　　在庫リスクをほぼゼロに抑えてスタートできるため　業界未経験でも成功の再現性が高いモデルです。　　ぜひこの機会に買取ビジネスの　儲けのカラクリをご確認ください。 ------------------------------- FCオンライン説明会 ------ 　全国2,000店舗突破！10年間の店舗継続率96.4％　　　　 “買取専門”だからこそ可能になる　　　　低リスク × 高収益のビジネスモデル　　　　　　＜視聴予約はこちら＞　　　https://fc-daikichi-kaitori.biz/26/ 　提供：株式会社エンパワー（買取大吉FC本部）　日程：　5月28日（木）14:00〜14:30　満席終了　　　　　 6月10日（水）14:00〜14:30 　　　　　 6月25日（木）14:00〜14:30 　　　　　※内容は同じです。 --------------------------------------------------------- 　◇ 説明会コンテンツ　・仕入れた瞬間に利益確定の仕組み　・リサイクル店との“本質的な違い” 　・未経験でも査定できる仕組み　・メルカリ、ヤフオクとの競争優位性　・新規事業としての収益性／リスク／継続性　在庫・価格変動・資金不足の“三大リスク”を排除　一般的なリユース事業は、仕入れ後、販売まで在庫を抱えるため　　・在庫リスク　　・価格変動リスク　　・資金不足リスク　この3つが避けられません。　　しかし、買取大吉の“買取専門”モデルはここを完全に断ち切ることで　「買い取り＝利益確定」が成立します。　少人数・小スペースで成立するため、　全国2,000店舗まで拡大する、高い収益性と継続性を実証しています。　市場は伸び続け、しかし店舗は不足しています　リユース市場は拡大を続けていますが、　その需要に対して店舗数が追いついていないのが現状です。　今回の説明会では、儲けのカラクリ・収益性・リスク構造・継続性について　オーナー視点で実例に基づいて解説いたします。　　新規事業の立ち上げをご検討中の方は、　ぜひご視聴ください。　　＜詳細はこちら＞　https://fc-daikichi-kaitori.biz/26/ 　 ━━━━━━━━━━━━━━━━━━━━━━ フランチャイズセミナー運営事務局電話：0120-889-859 住所：東京都中央区銀座7-13-6 ━━━━━━━━━━━━━━━━━━━━━━ 今後ご案内が不要な方は下記にてお手続きをお願いいたします。 https://fc-daikichi-kaitori.biz/mail/ ━━━━━━━━━━━━━━━━━━━━━━

2 weeks, 4 days

[PATCH 6.1 000/969] 6.1.175-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.175 release. There are 969 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:39 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.175-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.175-rc1 Linus Torvalds <torvalds(a)linux-foundation.org> security/keys: fix missed RCU read section on lookup Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: validate rx_req_idx to prevent out-of-bounds array access Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Ido Schimmel <idosch(a)nvidia.com> bridge: mcast: Fix a possible use-after-free when removing a bridge port Petr Machata <petrm(a)nvidia.com> net: bridge: Flush multicast groups when snooping is disabled Guangshuo Li <lgs201920130244(a)gmail.com> RDMA/rtrs: Fix use-after-free in path file creation cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: hp_accel: Check ACPI_COMPANION() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: preserve VLAN tags on trapped link-local frames Arınç ÜNAL <arinc.unal(a)arinc9.com> net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: fix FDB entries not aging out with short timeout Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: sync driver-specific behavior of MT7531 variants Matthew Leach <matthew.leach(a)collabora.com> wifi: ath11k: fix peer resolution on rx path when peer_id=0 P Praneesh <quic_ppranees(a)quicinc.com> wifi: ath11k: fix rssi station dump not updated in QCN9074 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring hashmap Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: initialize hw_ops for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update hal srng regs for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: remap ce register space for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update ce configurations for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update hw params for IPQ5018 Youghandhar Chintala <quic_youghand(a)quicinc.com> wifi: ath11k: Trigger sta disconnect on hardware restart Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/snapshot: fix dumping of the unaligned regions Felix Gu <ustc.gu(a)gmail.com> spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Sayali Patil <sayalip(a)linux.ibm.com> powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() Mikko Perttunen <mperttunen(a)nvidia.com> drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/dsi: don't dump registers past the mapped region Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Xiang Mei <xmei5(a)asu.edu> net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Nicolas Escande <nico.escande(a)gmail.com> wifi: ath11k: fix error path leaks in some WMI WOW calls Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Jiayuan Chen <jiayuan.chen(a)linux.dev> irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Myeonghun Pak <mhun512(a)gmail.com> net: lan966x: avoid unregistering netdev on register failure Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Kuniyuki Iwashima <kuniyu(a)google.com> tcp: Fix imbalanced icsk_accept_queue count. Florian Westphal <fw(a)strlen.de> netfilter: bridge: eb_tables: close module init race Florian Westphal <fw(a)strlen.de> netfilter: x_tables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: move to two-stage removal scheme Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xtables_unregister_table_exit Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xt_unregister_table_pre_exit Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: Exclude LEGACY TABLES on PREEMPT_RT. Breno Leitao <leitao(a)debian.org> netfilter: Make legacy configs user selectable Kuniyuki Iwashima <kuniyu(a)amazon.com> netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c Florian Westphal <fw(a)strlen.de> netfilter: xtables: fix up kconfig dependencies Florian Westphal <fw(a)strlen.de> netfilter: ebtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: xtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arptables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: x_tables: unregister the templates first Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization Maulik Shah <maulik.shah(a)oss.qualcomm.com> pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Takashi Iwai <tiwai(a)suse.de> HID: uclogic: Fix regression of input name assignment Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate GPIO pin LUT table size before iterating Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Julien Chauveau <chauveau.julien(a)gmail.com> drm/bridge: it66121: acquire reset GPIO in probe Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: set fwnode->secondary to NULL in fwnode_init() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Remove unused code to avoid build warning Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe Michael Bommarito <michael.bommarito(a)gmail.com> KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails Zhihao Cheng <chengzhihao1(a)huawei.com> cifs: Fix busy dentry used after unmounting John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Marcin Szycik <marcin.szycik(a)intel.com> ice: fix setting promisc mode while adding VID filter Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: reset connection on receiving queue overflow Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Michael Bommarito <michael.bommarito(a)gmail.com> net: ifb: report ethtool stats over num_tx_queues Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name David Carlier <devnexen(a)gmail.com> Bluetooth: ISO: drop ISO_END frames received without prior ISO_START Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> net: wwan: iosm: fix potential memory leaks in ipc_imem_init() Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Sasha Levin <sashal(a)kernel.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_lvds: fix hang on init failure Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915: skip __i915_request_skip() for already signaled requests Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Ye Bin <yebin10(a)huawei.com> smb/client: fix possible infinite loop and oob read in symlink_data() Qiang Ma <maqianga(a)uniontech.com> KVM: x86: Fix Xen hypercall tracepoint argument assignment Junrui Luo <moonafterrain(a)outlook.com> KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic Aaron Sacks <contact(a)xchglabs.com> KVM: Reject wrapped offset in kvm_reset_dirty_gfn() Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Li Xiasong <lixiasong1(a)huawei.com> netfilter: nf_conntrack_sip: get helper before allocating expectation Matt Vollrath <tactii(a)gmail.com> i40e: Cleanup PTP pins on probe failure Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Enable JFFS2 write buffer for S25FS256T Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix leaking free_bds Ryo Takakura <ryotkkr98(a)gmail.com> net: bcmgenet: Initialize u64 stats seq counter Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Liang Jie <liangjie(a)lixiang.com> smb: client: correctly handle ErrorContextData as a flexible array Paolo Abeni <pabeni(a)redhat.com> net/sched: cls_flower: revert unintended changes Jakub Kicinski <kuba(a)kernel.org> net: tls: fix strparser anchor skb leak on offload RX setup failure Petr Oros <poros(a)redhat.com> ice: fix NULL pointer dereference in ice_reset_all_vfs() Jacob Keller <jacob.e.keller(a)intel.com> ice: Pull common tasks into ice_vf_post_vsi_rebuild Petr Oros <poros(a)redhat.com> iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler Petr Oros <poros(a)redhat.com> iavf: wait for PF confirmation before removing VLAN filters Petr Oros <poros(a)redhat.com> iavf: stop removing VLAN filters from PF on interface down Petr Oros <poros(a)redhat.com> iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Jones Syue 薛懷宗 <jonessyue(a)qnap.com> bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex: Prevent lockup in requeue-PI during signal/ timeout wakeup wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Fix missing error check for jack detection wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 Oldherl Oh <me(a)oldherl.one> ALSA: hda/conexant: fix some typos Breno Leitao <leitao(a)debian.org> netconsole: propagate device name truncation in dev_name_store() Matthew Wood <thepacketgeek(a)gmail.com> net: netconsole: move newline trimming to function Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. William A. Kennington III <william(a)wkennington.com> net: mctp i2c: check length before marking flow active Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams Florian Westphal <fw(a)strlen.de> neigh: let neigh_xmit take skb ownership Eric Dumazet <edumazet(a)google.com> neighbour: add RCU protection to neigh_tables[] Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix slot delay calculation overflow Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() John Madieu <john.madieu(a)gmail.com> spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ Yang Yingliang <yangyingliang(a)huawei.com> spi: rockchip: switch to use modern name Lizhe <sensor1010(a)163.com> drivers/spi-rockchip.c : Remove redundant variable slave Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd3.1: Don't validate the firmware when already validated Alexandre Demers <alexandre.f.demers(a)gmail.com> drm/amdgpu: fix spelling typos Keith Busch <kbusch(a)kernel.org> nvme-pci: fix missed admin queue sq doorbell write Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Maurizio Lombardi <mlombard(a)redhat.com> nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Mieczyslaw Nalewaj <namiltd(a)yahoo.com> net: dsa: realtek: rtl8365mb: fix mode mask calculation Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: scope conn->binding slowpath to bound sessions only DaeMyung Kang <charsyam(a)gmail.com> ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->dsack_dups Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->bytes_retrans Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->bytes_sent Eric Dumazet <edumazet(a)google.com> tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans Eric Dumazet <edumazet(a)google.com> tcp: preserve const qualifier in tcp_sk() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> container_of: add container_of_const() that preserves const-ness of the pointer Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> container_of: remove container_of_safe() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/wm: Verify the correct plane DDB entry Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> drm/i915: Loop over all active pipes in intel_mbus_dbox_update Gustavo Sousa <gustavo.sousa(a)intel.com> drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Constify watermark state checker Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> f2fs: Use sysfs_emit_at() to simplify code Brian Masney <bmasney(a)redhat.com> clk: visconti: pll: initialize clk_init_data to zero Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for PCIe power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for USB power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Add missing GDSCs Val Packett <val(a)packett.cool> dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Pengpeng Hou <pengpeng(a)iscas.ac.cn> platform/x86: dell-wmi-sysman: bound enumeration string aggregation Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Pengpeng Hou <pengpeng(a)iscas.ac.cn> fs/ntfs3: terminate the cached volume label after UTF-8 conversion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices Chen Ni <nichen(a)iscas.ac.cn> leds: lgm-sso: Remove duplicate assignments for priv->mmap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Billy Tsai <billy_tsai(a)aspeedtech.com> i3c: mipi-i3c-hci: fix IBI payload length calculation for final status Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Mike Leach <mike.leach(a)arm.com> perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: Avoid returning positive values to user space Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: remove duplicate error message Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Puranjay Mohan <puranjay(a)kernel.org> bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT Yihan Ding <dingyihan(a)uniontech.com> bpf: allow UTF-8 literals in bpf_bprintf_prepare() Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix precedence bug in convert_bpf_ld_abs alignment check Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Take state lock for af_unix iter Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Fix af_unix null-ptr-deref in proto update Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Fix af_unix iter deadlock Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Fix off-by-one in check_imm signed range check Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path Shiji Yang <yangshiji66(a)outlook.com> mtd: spi-nor: swp: check SR_TB flag when getting tb_mask Jonas Gorski <jonas.gorski(a)gmail.com> mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: Allow post_sfdp hook to return errors Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Add support for Infineon S25FS256T Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Make RD_ANY_REG_OP macro take number of dummy bytes Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: spansion: Replace hardcoded values for addr_nbytes/addr_mode_nbytes Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Rename s28hs512t prefix Haibo Chen <haibo.chen(a)nxp.com> mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() Cole Leavitt <cole(a)unwrap.rs> soundwire: bus: demote UNATTACHED state warnings to dev_dbg() Khairul Anuar Romli <karom.9560(a)gmail.com> dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Christoph Hellwig <hch(a)lst.de> arm64/xor: fix conflicting attributes for xor_block_template Aaro Koskinen <aaro.koskinen(a)iki.fi> ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX Alexander Koskovich <AKoskovich(a)pm.me> arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: llcc: fix v1 SB syndrome register offset Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() Michal Grzedzicki <mge(a)meta.com> unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure Sumit Gupta <sumitg(a)nvidia.com> soc/tegra: cbb: Set ERD on resume for err interrupt David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sm8450: Fix GIC_ITS range length Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: register reasons for probe deferrals Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soc: qcom: ocmem: use scoped device node handling to simplify error paths Akari Tsuyukusa <akkun11.open(a)gmail.com> arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count Akari Tsuyukusa <akkun11.open(a)gmail.com> arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count Sherry Sun <sherry.sun(a)nxp.com> arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Joshua Klinesmith <joshuaklinesmith(a)gmail.com> ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: prevent NULL pointer dereference during unmount Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: add some missing log locking Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Call unlock_new_inode before d_instantiate Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix missing return in invalidate_committed's error path Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: sc6000: Keep the programmed board state in card-private data Takashi Iwai <tiwai(a)suse.de> ALSA: sc6000: Use standard print API Pei Xiao <xiaopei01(a)kylinos.cn> spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Allow system suspend when the Endpoint link is not up Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable PERST# IRQ only in Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Don't force the device into the D0 state before L2 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Increase LTSSM poll time on surprise link down Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Fix polling delay for L2 state Frank Li <Frank.Li(a)nxp.com> PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: compress: return the configured codec from get_params Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Add support for compress API for stream data/offset Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Prepare set_stream_data_offset for compress API Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Prepare ipc_msg_data to be used with compress API V sujith kumar Reddy <Vsujithkumar.Reddy(a)amd.com> ASoC: SOF: amd: Fix for reading position updates from stream box. Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> ALSA: scarlett2: Add missing sentinel initializer field Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement AnishMulay <anishm7030(a)gmail.com> selftests/mm: skip migration tests if NUMA is unavailable Chen-Yu Tsai <wenst(a)chromium.org> PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: qdsp6: topology: check widget type before accessing data Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_micfil: Fix event generation in micfil_quality_set() Felix Gu <ustc.gu(a)gmail.com> pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/shrinker: Fix can_block() logic Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Yuanjie Yang <yuanjie.yang(a)oss.qualcomm.com> drm/msm/dpu: fix mismatch between power and frequency Pei Xiao <xiaopei01(a)kylinos.cn> spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: look at the right prop for gfx queue priority Daniel Jordan <daniel.m.jordan(a)oracle.com> padata: Put CPU offline callback in ONLINE section to allow failure Chuyi Zhou <zhouchuyi(a)bytedance.com> padata: Remove cpu online check from cpu add and removal Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Guillaume Gonnet <ggonnet.linux(a)gmail.com> dm init: ensure device probing has finished in dm-mod.waitfor= Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu: Add default case in DVI mode validation Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write hang in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: backend: fix error pointer dereference Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Jiayuan Chen <jiayuan.chen(a)linux.dev> net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master Xin Long <lucien.xin(a)gmail.com> sctp: fix missing encap_port propagation for GSO fragments Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Florian Westphal <fw(a)strlen.de> netfilter: xt_socket: enable defrag after all other checks Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix racing timeout handler Zak Kemble <zakkemble(a)gmail.com> net: bcmgenet: switch to use 64bit statistics Doug Berger <opendmb(a)gmail.com> net: bcmgenet: support reclaiming unsent Tx packets Doug Berger <opendmb(a)gmail.com> net: bcmgenet: move DESC_INDEX flow to ring 0 Doug Berger <opendmb(a)gmail.com> net: bcmgenet: add bcmgenet_has_* helpers Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Remove custom ndo_poll_controller() Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Remove TX ring full logging Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Wang Wensheng <wsw9603(a)163.com> arm64: kexec: Remove duplicate allocation for trans_pgd Haoyu Lu <hechushiguitu666(a)gmail.com> ACPI: AGDI: fix missing newline in error message Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Eric Dumazet <edumazet(a)google.com> macvlan: annotate data-races around port->bc_queue_len_used Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: fix incorrect register write to USB_UPHY_XTAL Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() David Carlier <devnexen(a)gmail.com> bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Thorsten Blum <thorsten.blum(a)toblux.com> bpf, devmap: Remove unnecessary if check in for loop Petr Pavlu <petr.pavlu(a)suse.com> module: Fix freeing of charp module parameters when CONFIG_SYSFS=n Petr Pavlu <petr.pavlu(a)suse.com> params: Replace __modinit with __init_or_module Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: globalize lookup_or_create_module_kobject() Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: param: rename locate_module_kobject Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: add independent dependencies for FSL_DPAA2_SWITCH Feng Yang <yangfeng(a)kylinos.cn> bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap Vadim Fedorenko <vadfed(a)meta.com> bpf: Add CHECKSUM_COMPLETE to bpf test progs Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Thomas Gleixner <tglx(a)kernel.org> hrtimer: Reduce trace noise in hrtimer_start() Peter Zijlstra <peterz(a)infradead.org> hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() Richard Clark <richard.xnu.clark(a)gmail.com> hrtimers: Update the return type of enqueue_hrtimer() Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gui-Dong Han <hanguidong02(a)gmail.com> debugfs: check for NULL pointer in debugfs_create_str() Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Ming Lei <ming.lei(a)redhat.com> blk-cgroup: wait for blkcg cleanup before initializing new disk Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Amit Kumar Mahapatra <amit.kumar-mahapatra(a)amd.com> mtd: spi-nor: sst: Fix SST write failure Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Bence Csókás <csokas.bence(a)prolan.hu> mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Paul E. McKenney <paulmck(a)kernel.org> exit: Sleep at TASK_IDLE when waiting for application core dump Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Remove remaining dependencies of hci_request Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Dong Chenchen <dongchenchen2(a)huawei.com> net: Fix icmp host relookup triggering ip_rt_bug Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Chao Yu <chao(a)kernel.org> f2fs: fix to detect potential corrupted nid in free_nid_list Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> regset: use kvzalloc() for regset_get_alloc() Youngmin Nam <youngmin.nam(a)samsung.com> arm64: set __exception_irq_entry with __irq_entry as a default Ming Lei <ming.lei(a)redhat.com> blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none Jianpeng Chang <jianpeng.chang.cn(a)windriver.com> net: enetc: fix the deadlock of enetc_mdio_lock Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Mark Rutland <mark.rutland(a)arm.com> arm64: mm: fix VA-range sanity check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: read txq->read_ptr under lock Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Takashi Iwai <tiwai(a)suse.de> ALSA: control: Avoid WARN() for symlink errors André Draszik <andre.draszik(a)linaro.org> scsi: ufs: core: Fix use-after free in init error and remove paths David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Dawei Li <set_pte_at(a)outlook.com> soc: qcom: apr: make remove callback of apr driver void returned Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Ming Lei <ming.lei(a)redhat.com> ublk: fix deadlock when reading partition table David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: clean up FDB, MDB, VLAN entries on unbind Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Andrew Price <anprice(a)redhat.com> gfs2: Improve gfs2_consist_inode() usage Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Sasha Levin <sashal(a)kernel.org> Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()" Sasha Levin <sashal(a)kernel.org> Revert "net: ethernet: xscale: Check for PTP support properly" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Christian König <christian.koenig(a)amd.com> drm/amdgpu: remove two invalid BUG_ON()s Wang Liang <wangliang74(a)huawei.com> bonding: check xdp prog when set bond mode Hangbin Liu <liuhangbin(a)gmail.com> bonding: return detailed error when loading native XDP fails Eric Dumazet <edumazet(a)google.com> net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() Eric Dumazet <edumazet(a)google.com> net: add proper RCU protection to /proc/net/ptype Jeongjun Park <aha310510(a)gmail.com> ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Sasha Levin <sashal(a)kernel.org> Revert "dmaengine: idxd: Fix not releasing workqueue on .release()" Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Paolo Abeni <pabeni(a)redhat.com> epoll: use refcount to reduce ep_mutex contention Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Documentation/mm/hugetlbfs_reserv.rst | 2 +- Documentation/networking/bonding.rst | 15 + Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-omap1/clock_data.c | 4 +- arch/arm/mach-versatile/integrator_cp.c | 13 +- arch/arm/net/bpf_jit_32.c | 6 + .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- .../arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi | 2 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 2 +- .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 2 +- .../boot/dts/freescale/imx8mp-icore-mx8mp.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt6795.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 1 + arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 + arch/arm64/boot/dts/qcom/sm8450.dtsi | 5 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/exception.h | 5 - arch/arm64/include/asm/xor.h | 2 +- arch/arm64/kernel/machine_kexec.c | 3 - arch/arm64/kvm/vgic/vgic-its.c | 4 + arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/mm/mmu.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/mm/init.c | 4 - arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kernel/time.c | 6 +- arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/s390/kernel/debug.c | 8 + arch/s390/kvm/interrupt.c | 3 +- arch/s390/kvm/pci.c | 6 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kvm/mmu/mmu.c | 36 +- arch/x86/kvm/mmu/spte.h | 5 + arch/x86/kvm/svm/nested.c | 38 +- arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 13 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/trace.h | 2 +- arch/x86/kvm/x86.c | 14 +- block/blk-cgroup.c | 15 + block/blk-mq.c | 10 +- certs/extract-cert.c | 6 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/arm64/agdi.c | 2 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 39 +- drivers/base/dd.c | 20 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/block/rbd.c | 6 +- drivers/block/ublk_drv.c | 28 +- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/hci_ldisc.c | 51 +- drivers/bluetooth/virtio_bt.c | 39 +- drivers/bus/imx-weim.c | 2 +- drivers/cdrom/cdrom.c | 73 +- drivers/char/ipmi/ipmi_si_intf.c | 70 +- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/clk/qcom/dispcc-sm8450.c | 2 +- drivers/clk/qcom/gcc-sc8180x.c | 64 +- drivers/clk/visconti/pll.c | 2 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 - drivers/dma/idxd/sysfs.c | 1 - drivers/dma/mxs-dma.c | 1 + drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/arm_ffa/bus.c | 4 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/firmware/imx/scu-pd.c | 1 + drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 16 +- drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c | 3 +- drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 7 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++ drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 9 + .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 118 +++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h | 1 + drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 1 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- drivers/gpu/drm/bridge/chipone-icn6211.c | 4 +- drivers/gpu/drm/bridge/ite-it66121.c | 5 + .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/gma500/oaktrail_lvds.c | 9 +- drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_psr.c | 18 +- drivers/gpu/drm/i915/display/skl_watermark.c | 43 +- drivers/gpu/drm/i915/display/skl_watermark.h | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 3 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 - drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + drivers/gpu/drm/msm/msm_gem_shrinker.c | 5 +- drivers/gpu/drm/msm/msm_iommu.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 6 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/hid-uclogic-core.c | 4 +- drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 30 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- drivers/iommu/intel/iommu.c | 3 + drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/leds/blink/leds-lgm-sso.c | 2 - drivers/mailbox/mailbox-test.c | 39 +- drivers/mailbox/mailbox.c | 3 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 143 +++- drivers/md/dm-init.c | 4 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 +- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/saa7164/saa7164-core.c | 47 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 9 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/mtd/parsers/ofpart_core.c | 4 +- drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/core.h | 10 +- drivers/mtd/spi-nor/micron-st.c | 4 +- drivers/mtd/spi-nor/sfdp.c | 47 +- drivers/mtd/spi-nor/spansion.c | 106 ++- drivers/mtd/spi-nor/sst.c | 50 +- drivers/mtd/spi-nor/swp.c | 4 +- drivers/net/bareudp.c | 24 +- drivers/net/bonding/bond_3ad.c | 123 ++-- drivers/net/bonding/bond_main.c | 90 ++- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 74 +++ drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/dsa/mt7530.c | 85 +-- drivers/net/dsa/mt7530.h | 70 +- drivers/net/dsa/realtek/rtl8365mb.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 733 +++++++++------------ drivers/net/ethernet/broadcom/genet/bcmgenet.h | 68 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/freescale/Makefile | 3 +- drivers/net/ethernet/freescale/dpaa2/Kconfig | 4 + drivers/net/ethernet/freescale/enetc/enetc.c | 25 +- drivers/net/ethernet/ibm/ibmveth.c | 22 + drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 +- drivers/net/ethernet/intel/iavf/iavf.h | 9 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 52 +- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 76 +-- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 2 - drivers/net/ethernet/intel/ice/ice_vf_lib.c | 26 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 +- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 8 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 35 +- .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 2 + drivers/net/ethernet/xscale/ixp4xx_eth.c | 60 +- drivers/net/ethernet/xscale/ptp_ixp46x.c | 3 - drivers/net/hamradio/6pack.c | 39 +- drivers/net/ifb.c | 11 +- drivers/net/macvlan.c | 8 +- drivers/net/mctp/mctp-i2c.c | 4 +- drivers/net/netconsole.c | 26 +- drivers/net/netdevsim/dev.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/phy/mdio_bus.c | 4 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireless/ath/ath11k/ahb.c | 44 +- drivers/net/wireless/ath/ath11k/ce.h | 16 + drivers/net/wireless/ath/ath11k/core.c | 91 +++ drivers/net/wireless/ath/ath11k/core.h | 12 + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +- drivers/net/wireless/ath/ath11k/hal.c | 31 +- drivers/net/wireless/ath/ath11k/hal.h | 5 + drivers/net/wireless/ath/ath11k/hal_rx.c | 13 +- drivers/net/wireless/ath/ath11k/hal_rx.h | 18 +- drivers/net/wireless/ath/ath11k/hw.c | 398 ++++++++++- drivers/net/wireless/ath/ath11k/hw.h | 14 +- drivers/net/wireless/ath/ath11k/mac.c | 7 + drivers/net/wireless/ath/ath11k/pci.c | 2 + drivers/net/wireless/ath/ath11k/wmi.c | 19 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 15 + .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/intel/iwlwifi/queue/tx.c | 3 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/net/wireless/realtek/rtw89/phy.c | 2 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 + drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 3 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 51 +- drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 151 ++--- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/controller/pcie-mediatek-gen3.c | 8 +- drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 19 +- drivers/pci/pci.c | 48 +- drivers/pci/pci.h | 6 + drivers/pci/pcie/aer.c | 2 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 27 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/pinctrl/qcom/pinctrl-sm8150.c | 8 +- drivers/platform/surface/surfacepro3_button.c | 1 + drivers/platform/x86/adv_swbutton.c | 6 +- .../x86/dell/dell-wmi-sysman/enum-attributes.c | 34 +- drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/platform/x86/hp/hp_accel.c | 3 + drivers/platform/x86/intel/hid.c | 6 +- drivers/platform/x86/intel/vbtn.c | 6 +- drivers/platform/x86/panasonic-laptop.c | 5 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/pwm/pwm-imx-tpm.c | 8 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/rtc/rtc-ntxec.c | 2 +- drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/sd.c | 1 + drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 11 +- drivers/scsi/sr.h | 1 - drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/llcc-qcom.c | 2 +- drivers/soc/qcom/ocmem.c | 22 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/tegra/cbb/tegra234-cbb.c | 4 + drivers/soc/ti/omap_prm.c | 1 + drivers/soundwire/bus.c | 8 +- drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-hisi-kunpeng.c | 12 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mtk-snfi.c | 16 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 66 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 2 +- drivers/ufs/core/ufshcd.c | 31 +- drivers/ufs/host/ufshcd-pci.c | 2 - drivers/ufs/host/ufshcd-pltfrm.c | 25 +- drivers/usb/class/cdc-acm.c | 53 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/binfmt_elf.c | 2 +- fs/btrfs/inode.c | 2 +- fs/btrfs/space-info.c | 2 +- fs/ceph/xattr.c | 1 + fs/dcache.c | 4 +- fs/debugfs/file.c | 5 +- fs/erofs/dir.c | 28 +- fs/eventpoll.c | 201 ++++-- fs/ext2/inode.c | 14 +- fs/ext4/extents.c | 15 + fs/ext4/xattr.c | 4 +- fs/f2fs/compress.c | 90 +-- fs/f2fs/data.c | 28 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 17 +- fs/f2fs/super.c | 8 +- fs/f2fs/sysfs.c | 52 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 37 +- fs/gfs2/glops.c | 40 +- fs/gfs2/inode.c | 3 +- fs/gfs2/log.c | 33 +- fs/gfs2/xattr.c | 28 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/fslog.c | 12 +- fs/ntfs3/run.c | 18 +- fs/ntfs3/super.c | 7 +- fs/ocfs2/aops.c | 75 ++- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/inode.c | 31 + fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 4 +- fs/omfs/inode.c | 6 + fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifs_spnego.c | 16 + fs/smb/client/cifsacl.c | 1 + fs/smb/client/cifsfs.c | 2 + fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 27 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 17 + fs/smb/client/smb2pdu.h | 2 +- fs/smb/server/auth.c | 11 +- fs/smb/server/mgmt/user_session.c | 12 +- fs/smb/server/smb2pdu.c | 7 + fs/smb/server/smbacl.c | 19 +- fs/smb/server/transport_tcp.c | 4 +- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 5 + include/linux/cdrom.h | 1 + include/linux/container_of.h | 23 +- include/linux/cpuhotplug.h | 1 - include/linux/dev_printk.h | 10 + include/linux/device.h | 48 +- include/linux/dmi.h | 5 + include/linux/f2fs_fs.h | 1 + include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 45 +- include/linux/kvm_host.h | 3 +- include/linux/module.h | 2 + include/linux/moduleparam.h | 11 +- include/linux/netfilter/x_tables.h | 3 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/linux/padata.h | 12 +- include/linux/ppp_defs.h | 16 + include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/soc/qcom/apr.h | 2 +- include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/tcp.h | 10 +- include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/bluetooth/hci_sync.h | 17 + include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 4 + include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/netfilter/nf_queue.h | 1 + include/net/netfilter/nf_tables.h | 2 + include/net/pie.h | 2 +- include/net/pkt_cls.h | 2 + include/net/route.h | 6 - include/net/tcp.h | 2 +- include/net/udp_tunnel.h | 15 + include/trace/events/btrfs.h | 9 +- include/trace/events/rxrpc.h | 4 + include/trace/events/timer.h | 11 +- include/uapi/linux/bpf.h | 2 + include/uapi/linux/if_link.h | 3 + include/uapi/linux/kvm.h | 11 +- include/ufs/ufshcd.h | 1 - include/video/udlfb.h | 1 + init/main.c | 1 - io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 2 + io_uring/poll.c | 14 +- io_uring/timeout.c | 4 + kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/devmap.c | 8 +- kernel/bpf/helpers.c | 17 +- kernel/bpf/local_storage.c | 2 +- kernel/cgroup/rdma.c | 2 +- kernel/exit.c | 3 +- kernel/fork.c | 13 +- kernel/futex/requeue.c | 13 +- kernel/irq_work.c | 7 + kernel/locking/rtmutex.c | 13 +- kernel/module/main.c | 4 +- kernel/padata.c | 266 +++----- kernel/params.c | 46 +- kernel/regset.c | 6 +- kernel/taskstats.c | 1 + kernel/time/hrtimer.c | 56 +- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 ++- net/batman-adv/bridge_loop_avoidance.c | 65 +- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 +- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/af_bluetooth.c | 10 + net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_event.c | 21 +- net/bluetooth/hci_request.h | 21 - net/bluetooth/hci_sync.c | 14 +- net/bluetooth/iso.c | 14 +- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 60 +- net/bluetooth/mgmt.c | 6 + net/bluetooth/rfcomm/sock.c | 9 +- net/bluetooth/sco.c | 9 +- net/bpf/test_run.c | 63 +- net/bridge/br_multicast.c | 27 +- net/bridge/netfilter/Kconfig | 13 + net/bridge/netfilter/Makefile | 2 +- net/bridge/netfilter/ebtable_broute.c | 14 +- net/bridge/netfilter/ebtable_filter.c | 14 +- net/bridge/netfilter/ebtable_nat.c | 12 +- net/bridge/netfilter/ebtables.c | 71 +- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/auth.c | 4 +- net/ceph/crush/crush.c | 6 +- net/ceph/mon_client.c | 2 + net/ceph/osdmap.c | 14 +- net/core/filter.c | 4 +- net/core/flow_dissector.c | 13 +- net/core/neighbour.c | 34 +- net/core/net-procfs.c | 49 +- net/core/rtnetlink.c | 1 + net/dsa/dsa2.c | 38 +- net/ethtool/bitset.c | 8 +- net/ipv4/icmp.c | 15 +- net/ipv4/inet_connection_sock.c | 5 +- net/ipv4/netfilter/Kconfig | 59 +- net/ipv4/netfilter/Makefile | 2 +- net/ipv4/netfilter/arp_tables.c | 36 +- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/netfilter/arptable_filter.c | 27 +- net/ipv4/netfilter/ip_tables.c | 18 +- net/ipv4/netfilter/iptable_filter.c | 27 +- net/ipv4/netfilter/iptable_mangle.c | 29 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 26 +- net/ipv4/netfilter/iptable_security.c | 27 +- net/ipv4/nexthop.c | 4 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 -- net/ipv4/tcp.c | 17 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_minisocks.c | 5 +- net/ipv4/tcp_output.c | 20 +- net/ipv4/tcp_recovery.c | 2 +- net/ipv4/udp_tunnel_core.c | 48 ++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 -- net/ipv6/ip6_udp_tunnel.c | 69 ++ net/ipv6/netfilter/Kconfig | 30 +- net/ipv6/netfilter/Makefile | 2 +- net/ipv6/netfilter/ip6_tables.c | 18 +- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/netfilter/ip6table_filter.c | 26 +- net/ipv6/netfilter/ip6table_mangle.c | 27 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 24 +- net/ipv6/netfilter/ip6table_security.c | 27 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 4 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/Kconfig | 22 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 160 +++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nf_queue.c | 4 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_dynset.c | 10 +- net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/x_tables.c | 116 +++- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/netfilter/xt_socket.c | 23 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport-netdev.c | 6 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 9 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 8 +- net/sched/em_cmp.c | 5 +- net/sched/em_nbyte.c | 2 + net/sched/em_text.c | 11 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 26 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 44 +- net/sched/sch_pie.c | 52 +- net/sched/sch_red.c | 33 +- net/sched/sch_sfb.c | 54 +- net/sched/sch_taprio.c | 176 ++--- net/sctp/inqueue.c | 1 + net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/af_smc.c | 3 +- net/smc/smc_clc.c | 4 +- net/smc/smc_tracepoint.h | 2 +- net/strparser/strparser.c | 8 + net/tipc/msg.c | 14 +- net/tls/tls.h | 1 + net/tls/tls_strp.c | 6 + net/tls/tls_sw.c | 30 +- net/unix/af_unix.c | 9 +- net/unix/diag.c | 21 +- net/unix/unix_bpf.c | 3 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 23 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 2 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 17 +- security/integrity/ima/ima_crypto.c | 2 +- security/keys/keyring.c | 1 + sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 7 - sound/core/control.c | 4 + sound/core/control_led.c | 14 +- sound/core/misc.c | 44 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/isa/sc6000.c | 285 ++++---- sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_conexant.c | 34 +- sound/pci/hda/patch_realtek.c | 8 +- sound/soc/amd/yc/acp6x-mach.c | 35 + sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++- sound/soc/fsl/fsl_micfil.c | 28 +- sound/soc/fsl/fsl_xcvr.c | 22 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 17 +- sound/soc/qcom/qdsp6/q6core.c | 4 +- sound/soc/qcom/qdsp6/topology.c | 8 +- sound/soc/soc-core.c | 1 + sound/soc/sof/amd/acp-common.c | 1 + sound/soc/sof/amd/acp-ipc.c | 34 +- sound/soc/sof/amd/acp.h | 7 +- sound/soc/sof/compress.c | 11 +- sound/soc/sof/intel/hda-ipc.c | 8 +- sound/soc/sof/intel/hda.h | 4 +- sound/soc/sof/ipc3-pcm.c | 3 +- sound/soc/sof/ipc3.c | 4 +- sound/soc/sof/mediatek/mt8186/mt8186.c | 2 +- sound/soc/sof/mediatek/mt8195/mt8195.c | 2 +- sound/soc/sof/ops.h | 8 +- sound/soc/sof/pcm.c | 2 + sound/soc/sof/sof-priv.h | 13 +- sound/soc/sof/stream-ipc.c | 57 +- sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +- sound/usb/caiaq/device.c | 39 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 88 ++- sound/usb/midi.c | 21 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/mixer_scarlett2.c | 2 +- sound/usb/quirks.c | 4 +- sound/usb/stream.c | 62 +- sound/usb/stream.h | 3 +- tools/accounting/getdelays.c | 41 +- tools/accounting/procacct.c | 40 +- tools/include/uapi/linux/bpf.h | 2 + tools/lib/bpf/relo_core.c | 2 + tools/perf/util/branch.h | 3 + tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 51 +- tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 37 +- tools/testing/selftests/bpf/prog_tests/snprintf.c | 3 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- .../testing/selftests/mqueue/{setting => settings} | 0 .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + tools/testing/selftests/vm/migration.c | 3 +- virt/kvm/dirty_ring.c | 3 +- 867 files changed, 9112 insertions(+), 4400 deletions(-)

3 weeks

[PATCH 5.15 000/776] 5.15.209-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.209 release. There are 776 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.209-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.209-rc1 Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: validate rx_req_idx to prevent out-of-bounds array access Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Ido Schimmel <idosch(a)nvidia.com> bridge: mcast: Fix a possible use-after-free when removing a bridge port Petr Machata <petrm(a)nvidia.com> net: bridge: Flush multicast groups when snooping is disabled Guangshuo Li <lgs201920130244(a)gmail.com> RDMA/rtrs: Fix use-after-free in path file creation cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: hp_accel: Check ACPI_COMPANION() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: preserve VLAN tags on trapped link-local frames Arınç ÜNAL <arinc.unal(a)arinc9.com> net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: fix FDB entries not aging out with short timeout Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: sync driver-specific behavior of MT7531 variants Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/snapshot: fix dumping of the unaligned regions Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Mikko Perttunen <mperttunen(a)nvidia.com> drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Nicolas Escande <nico.escande(a)gmail.com> wifi: ath11k: fix error path leaks in some WMI WOW calls Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Kuniyuki Iwashima <kuniyu(a)google.com> tcp: Fix imbalanced icsk_accept_queue count. Florian Westphal <fw(a)strlen.de> netfilter: bridge: eb_tables: close module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: move to two-stage removal scheme Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xtables_unregister_table_exit Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xt_unregister_table_pre_exit Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: Exclude LEGACY TABLES on PREEMPT_RT. Breno Leitao <leitao(a)debian.org> netfilter: Make legacy configs user selectable Kuniyuki Iwashima <kuniyu(a)amazon.com> netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c Florian Westphal <fw(a)strlen.de> netfilter: xtables: fix up kconfig dependencies Florian Westphal <fw(a)strlen.de> netfilter: ebtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: xtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arptables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arp_tables: allow use of arpt_do_table as hookfn Florian Westphal <fw(a)strlen.de> netfilter: x_tables: unregister the templates first Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Julien Chauveau <chauveau.julien(a)gmail.com> drm/bridge: it66121: acquire reset GPIO in probe Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: set fwnode->secondary to NULL in fwnode_init() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name Abdun Nihaal <nihaal(a)cse.iitm.ac.in> net: wwan: iosm: fix potential memory leaks in ipc_imem_init() Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Sasha Levin <sashal(a)kernel.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Sean Christopherson <seanjc(a)google.com> KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915: skip __i915_request_skip() for already signaled requests Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Qiang Ma <maqianga(a)uniontech.com> KVM: x86: Fix Xen hypercall tracepoint argument assignment Aaron Sacks <contact(a)xchglabs.com> KVM: Reject wrapped offset in kvm_reset_dirty_gfn() Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Matt Vollrath <tactii(a)gmail.com> i40e: Cleanup PTP pins on probe failure Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Qingqing Yang <qingqing.yang(a)broadcom.com> flow_dissector: Do not count vlan tags inside tunnel payload Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Do not dereference non-socket transports in sysfs Anna Schumaker <Anna.Schumaker(a)Netapp.com> SUNRPC: Check if the xprt is connected before handling sysfs reads Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Fix missing error check for jack detection wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 Oldherl Oh <me(a)oldherl.one> ALSA: hda/conexant: fix some typos bo liu <bo.liu(a)senarytech.com> ALSA: hda/conexant: add a new hda codec SN6140 Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: choke: remove unused variables in struct choke_sched_data Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> net: sched: sch_netem: Refactor code in 4-state loss generator Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() Enze Li <lienze(a)kylinos.cn> scsi: sr: Add memory allocation failure handling for get_capabilities() Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd3.1: Don't validate the firmware when already validated Alexandre Demers <alexandre.f.demers(a)gmail.com> drm/amdgpu: fix spelling typos Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: gred/red: remove unused variables in struct red_stats Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: scope conn->binding slowpath to bound sessions only DaeMyung Kang <charsyam(a)gmail.com> ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Wojciech Drewek <wojciech.drewek(a)intel.com> flow_dissector: Add PPPoE dissectors Boris Sukholitko <boris.sukholitko(a)broadcom.com> flow_dissector: Add number of vlan tags dissector Boris Sukholitko <boris.sukholitko(a)broadcom.com> dissector: do not set invalid PPP protocol Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: replace safety precautions with comments Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: stop going through private ops for dequeue and peek Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for PCIe power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for USB power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Add missing GDSCs Val Packett <val(a)packett.cool> dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Pengpeng Hou <pengpeng(a)iscas.ac.cn> platform/x86: dell-wmi-sysman: bound enumeration string aggregation Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Pengpeng Hou <pengpeng(a)iscas.ac.cn> fs/ntfs3: terminate the cached volume label after UTF-8 conversion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices наб <nabijaczleweli(a)nabijaczleweli.xyz> tty: hvc: remove HVC_IUCV_MAGIC Chen Ni <nichen(a)iscas.ac.cn> leds: lgm-sso: Remove duplicate assignments for priv->mmap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Billy Tsai <billy_tsai(a)aspeedtech.com> i3c: mipi-i3c-hci: fix IBI payload length calculation for final status Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Mike Leach <mike.leach(a)arm.com> perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path Shiji Yang <yangshiji66(a)outlook.com> mtd: spi-nor: swp: check SR_TB flag when getting tb_mask Haibo Chen <haibo.chen(a)nxp.com> mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() Khairul Anuar Romli <karom.9560(a)gmail.com> dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() Michal Grzedzicki <mge(a)meta.com> unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: register reasons for probe deferrals Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soc: qcom: ocmem: use scoped device node handling to simplify error paths Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Joshua Klinesmith <joshuaklinesmith(a)gmail.com> ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: prevent NULL pointer dereference during unmount Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: add some missing log locking Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: sc6000: Keep the programmed board state in card-private data Takashi Iwai <tiwai(a)suse.de> ALSA: sc6000: Use standard print API Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Increase LTSSM poll time on surprise link down Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Fix polling delay for L2 state Frank Li <Frank.Li(a)nxp.com> PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() Felix Gu <ustc.gu(a)gmail.com> pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Pei Xiao <xiaopei01(a)kylinos.cn> spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Guillaume Gonnet <ggonnet.linux(a)gmail.com> dm init: ensure device probing has finished in dm-mod.waitfor= Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Jiayuan Chen <jiayuan.chen(a)linux.dev> net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master Xin Long <lucien.xin(a)gmail.com> sctp: fix missing encap_port propagation for GSO fragments Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: qcom: at803x: Use the correct bit to disable extended next page Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Florian Westphal <fw(a)strlen.de> netfilter: xt_socket: enable defrag after all other checks Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Frederick Lawler <fred(a)cloudflare.com> bpf-lsm: Make bpf_lsm_userns_create() sleepable Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Eric Dumazet <edumazet(a)google.com> macvlan: annotate data-races around port->bc_queue_len_used Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: fix incorrect register write to USB_UPHY_XTAL David Carlier <devnexen(a)gmail.com> bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Thorsten Blum <thorsten.blum(a)toblux.com> bpf, devmap: Remove unnecessary if check in for loop Petr Pavlu <petr.pavlu(a)suse.com> module: Fix freeing of charp module parameters when CONFIG_SYSFS=n Petr Pavlu <petr.pavlu(a)suse.com> params: Replace __modinit with __init_or_module Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: globalize lookup_or_create_module_kobject() Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: param: rename locate_module_kobject Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: add independent dependencies for FSL_DPAA2_SWITCH Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gui-Dong Han <hanguidong02(a)gmail.com> debugfs: check for NULL pointer in debugfs_create_str() Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Florian Fainelli <florian.fainelli(a)broadcom.com> um: virt-pci: Fix build failure Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: do not expire session on binding failure Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix backport of io_poll_add() changes Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe André Draszik <andre.draszik(a)linaro.org> scsi: ufs: core: Fix use-after free in init error and remove paths Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Jeongjun Park <aha310510(a)gmail.com> ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix flow control handling in tx path Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Vasant Karasulli <vsntk18(a)gmail.com> iommu: fix a reference count leak in iommu_sva_bind_device() David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: unset conn->binding on failed binding request Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" David Gow <davidgow(a)google.com> drivers: base: Free devm resources when unregistering a device Miquel Sabaté Solà <mikisabate(a)gmail.com> cpufreq: Avoid a bad reference count on CPU node Jakub Kicinski <kuba(a)kernel.org> net: clear the dst when changing skb protocol Thomas Weißschuh <linux(a)weissschuh.net> fbdev: efifb: Register sysfs groups through driver core Yu Kuai <yukuai3(a)huawei.com> md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang <liaochang1(a)huawei.com> cpufreq: governor: Free dbs_data directly when gov->init() fails David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Add more attributes checks in mi_enum_attr() Filipe Manana <fdmanana(a)suse.com> btrfs: lock the inode in shared mode before starting fiemap Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation NeilBrown <neilb(a)suse.de> SUNRPC: lock against ->sock changing during sysfs read Chao Yu <chao(a)kernel.org> f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode Lin Ma <linma(a)zju.edu.cn> vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: af_bluetooth: Fix deadlock Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch when turning buffer off Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: Add netif_device_attach/detach into PF reset flow Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Kill timer properly at removal Kees Cook <keescook(a)chromium.org> pstore: inode: Only d_invalidate() is needed Chao Yu <chao(a)kernel.org> f2fs: fix to wait on block writeback for post_read case Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix TSO DMA API usage causing oops Daniel Wagner <dwagner(a)suse.de> nvmet: always initialize cqe.result Lang Yu <Lang.Yu(a)amd.com> drm/amdgpu: unmap and remove csa_va properly Zilin Guan <zilin(a)seu.edu.cn> binfmt_misc: restore write access before closing files opened by open_exec() Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: No more self recovery Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO Alexander Aring <aahringo(a)redhat.com> dlm: fix possible lkb_resource null dereference Kuniyuki Iwashima <kuniyu(a)google.com> Bluetooth: hci_core: Fix use-after-free in vhci_flush() Joonwon Kang <joonwonkang(a)google.com> mailbox: Prevent out-of-bounds access in of_mbox_index_xlate() Qu Wenruo <wqu(a)suse.com> btrfs: do not strictly require dirty metadata threshold for metadata writepages Qu Wenruo <wqu(a)suse.com> btrfs: send: check for inline extents in range_is_hole_in_parent() Oleg Nesterov <oleg(a)redhat.com> x86/uprobes: Fix XOL allocation failure for 32-bit tasks Khairul Anuar Romli <khairul.anuar.romli(a)altera.com> spi: cadence-quadspi: Implement refcount to handle unbind during busy Alexander Aring <aahringo(a)redhat.com> fs: dlm: fix use after free in midcomms commit Guodong Xu <guodong(a)riscstar.com> dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Eric Dumazet <edumazet(a)google.com> net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet <edumazet(a)google.com> net: add skb_header_pointer_careful() helper Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: disable recursive forward error correction Keith Busch <kbusch(a)kernel.org> blk-mq: use quiesced elevator switch when reinitializing queues Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: read txq->read_ptr under lock Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Heiko Carstens <hca(a)linux.ibm.com> s390/xor: Fix xor_xc_2() inline assembly constraints Takashi Iwai <tiwai(a)suse.de> ALSA: control: Avoid WARN() for symlink errors Jaskaran Singh <jsingh(a)cloudlinux.com> nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Jaskaran Singh <jsingh(a)cloudlinux.com> Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Wang Yufen <wangyufen(a)huawei.com> netdevsim: Fix memory leak of nsim_dev->fa_cookie Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix deadlock and link starvation in outgoing data path Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write hongnanli <hongnan.li(a)linux.alibaba.com> fs/ocfs2: fix comments mentioning i_mutex Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Håkon Bugge <haakon.bugge(a)oracle.com> PCI/ACPI: Restrict program_hpx_type2() to AER bits Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Andrew Price <anprice(a)redhat.com> gfs2: Improve gfs2_consist_inode() usage Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Sasha Levin <sashal(a)kernel.org> Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()" Sasha Levin <sashal(a)kernel.org> Revert "net: ethernet: xscale: Check for PTP support properly" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Cezar Bulinaru <cbulinaru(a)gmail.com> net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Paulo Alcantara <pc(a)manguebit.com> smb: client: fix potential UAF in smb2_is_valid_oplock_break() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> fsl-mc: Use driver_set_override() instead of open-coding Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Update for native DSD support quirks Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Jamie Iles <quic_jiles(a)quicinc.com> i3c: fix uninitialized variable use in i2c setup Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Paolo Abeni <pabeni(a)redhat.com> epoll: use refcount to reduce ep_mutex contention Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning ------------- Diffstat: Documentation/vm/hugetlbfs_reserv.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-integrator/integrator_cp.c | 13 +- .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 1 + arch/arm64/crypto/aes-modes.S | 4 +- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 299 ++++++++++++--- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 20 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/s390/kernel/debug.c | 8 + arch/s390/lib/xor.c | 4 +- arch/um/drivers/cow_user.c | 8 +- arch/um/drivers/virt-pci.c | 2 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/svm/nested.c | 24 +- arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 13 + arch/x86/kvm/trace.h | 2 +- arch/x86/kvm/x86.c | 18 +- block/blk-mq.c | 6 +- block/blk.h | 3 +- block/elevator.c | 4 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 39 +- drivers/base/dd.c | 20 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/bluetooth/hci_ldisc.c | 51 ++- drivers/bluetooth/virtio_bt.c | 39 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 25 +- drivers/cdrom/cdrom.c | 73 ++-- drivers/char/ipmi/ipmi_si_intf.c | 70 +++- drivers/char/ipmi/ipmi_ssif.c | 74 +++- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/clk/qcom/gcc-sc8180x.c | 64 +++- drivers/cpufreq/cpufreq_governor.c | 10 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 - drivers/dma/mmp_pdma.c | 6 + drivers/dma/mxs-dma.c | 1 + drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/arm_ffa/bus.c | 4 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/firmware/imx/scu-pd.c | 1 + drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 16 +- drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c | 3 +- drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 + drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++++ .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 118 +++++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h | 1 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- drivers/gpu/drm/bridge/ite-it66121.c | 5 + .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/gt/intel_reset.c | 3 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/msm/msm_iommu.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i3c/master.c | 7 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 30 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 + drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- drivers/iommu/intel/iommu.c | 3 + drivers/iommu/iommu.c | 6 +- drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/leds/blink/leds-lgm-sso.c | 2 - drivers/mailbox/mailbox-test.c | 39 +- drivers/mailbox/mailbox.c | 9 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 111 ++++-- drivers/md/dm-init.c | 4 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 12 +- drivers/md/dm-verity-fec.h | 3 - drivers/md/md-bitmap.c | 4 + drivers/md/md.c | 4 + drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +-- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/mtd/parsers/ofpart_core.c | 4 +- drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/swp.c | 4 +- drivers/net/bareudp.c | 24 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/can/usb/gs_usb.c | 17 +- drivers/net/dsa/mt7530.c | 85 ++--- drivers/net/dsa/mt7530.h | 70 ++-- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 15 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/freescale/Makefile | 3 +- drivers/net/ethernet/freescale/dpaa2/Kconfig | 4 + drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 +- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ice/ice_main.c | 8 + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 6 + drivers/net/ethernet/microsoft/mana/hw_channel.c | 35 +- .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +- drivers/net/ethernet/xscale/ixp4xx_eth.c | 60 +-- drivers/net/ethernet/xscale/ptp_ixp46x.c | 3 - drivers/net/hamradio/6pack.c | 39 +- drivers/net/macvlan.c | 8 +- drivers/net/netdevsim/dev.c | 3 +- drivers/net/phy/at803x.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/phy/mdio_bus.c | 4 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 ++- drivers/net/tap.c | 23 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/lan78xx.c | 31 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireless/ath/ath11k/hal.c | 14 +- drivers/net/wireless/ath/ath11k/wmi.c | 19 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 15 + .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/intel/iwlwifi/queue/tx.c | 3 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 + drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/core.c | 3 +- drivers/nvme/target/fabrics-cmd.c | 6 - drivers/of/property.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 74 ++-- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +-- drivers/pci/endpoint/functions/pci-epf-vntb.c | 18 +- drivers/pci/pci-acpi.c | 59 ++- drivers/pci/pci.c | 48 ++- drivers/pci/pci.h | 9 + drivers/pci/pcie/aer.c | 5 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/platform/surface/surfacepro3_button.c | 1 + drivers/platform/x86/adv_swbutton.c | 6 +- .../x86/dell/dell-wmi-sysman/enum-attributes.c | 34 +- drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/platform/x86/hp/hp_accel.c | 3 + drivers/platform/x86/intel/hid.c | 6 +- drivers/platform/x86/intel/vbtn.c | 6 +- drivers/platform/x86/panasonic-laptop.c | 5 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/rtc/rtc-ntxec.c | 2 +- drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 25 +- drivers/scsi/sr.h | 1 - drivers/scsi/ufs/ufshcd-pci.c | 2 - drivers/scsi/ufs/ufshcd-pltfrm.c | 25 +- drivers/scsi/ufs/ufshcd.c | 31 +- drivers/scsi/ufs/ufshcd.h | 1 - drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/ocmem.c | 22 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/ti/omap_prm.c | 1 + drivers/spi/spi-cadence-quadspi.c | 34 ++ drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-hisi-kunpeng.c | 12 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 11 +- drivers/tty/n_gsm.c | 407 ++++++++++++++------- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vdpa/vdpa.c | 1 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/efifb.c | 11 +- drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/binfmt_misc.c | 4 +- fs/btrfs/disk-io.c | 23 -- fs/btrfs/extent_io.c | 5 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/inode.c | 2 +- fs/btrfs/send.c | 4 + fs/ceph/xattr.c | 1 + fs/cifs/cifs_spnego.c | 16 + fs/cifs/fs_context.c | 4 + fs/cifs/smb2misc.c | 2 + fs/debugfs/file.c | 5 +- fs/dlm/lock.c | 5 +- fs/dlm/midcomms.c | 7 + fs/eventpoll.c | 201 ++++++---- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 4 +- fs/f2fs/data.c | 13 +- fs/f2fs/super.c | 8 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 37 +- fs/gfs2/glops.c | 40 +- fs/gfs2/log.c | 33 +- fs/gfs2/util.c | 30 +- fs/gfs2/xattr.c | 28 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/ksmbd/auth.c | 11 +- fs/ksmbd/mgmt/user_session.c | 12 +- fs/ksmbd/smb2pdu.c | 11 +- fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/fslog.c | 12 +- fs/ntfs3/record.c | 63 +++- fs/ntfs3/run.c | 18 +- fs/ntfs3/super.c | 7 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/aops.c | 75 ++-- fs/ocfs2/cluster/nodemanager.c | 2 +- fs/ocfs2/dir.c | 4 +- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/file.c | 4 +- fs/ocfs2/inode.c | 33 +- fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/localalloc.c | 6 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/namei.c | 2 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 6 +- fs/omfs/inode.c | 6 + fs/pstore/inode.c | 10 +- fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 +- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 5 + include/linux/cdrom.h | 1 + include/linux/cpufreq.h | 5 +- include/linux/dev_printk.h | 10 + include/linux/device.h | 48 ++- include/linux/dmi.h | 5 + include/linux/fsl/mc.h | 6 +- include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 41 ++- include/linux/kvm_host.h | 3 +- include/linux/module.h | 2 + include/linux/moduleparam.h | 11 +- include/linux/netfilter/x_tables.h | 3 +- include/linux/netfilter_arp/arp_tables.h | 6 +- include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/linux/padata.h | 4 - include/linux/ppp_defs.h | 30 ++ include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/skbuff.h | 12 + include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/sunrpc/xprt.h | 3 + include/linux/sunrpc/xprtsock.h | 1 - include/linux/tpm_eventlog.h | 9 +- include/linux/uprobes.h | 1 + include/linux/usb.h | 3 +- include/net/bluetooth/hci_core.h | 2 + include/net/flow_dissector.h | 22 ++ include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/netfilter/nf_queue.h | 1 + include/net/netfilter/nf_tables.h | 2 + include/net/pie.h | 2 +- include/net/red.h | 1 - include/net/route.h | 6 - include/net/udp_tunnel.h | 15 + include/trace/events/btrfs.h | 9 +- include/trace/events/rxrpc.h | 8 + include/uapi/linux/mii.h | 3 +- include/video/udlfb.h | 1 + io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 37 +- kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/bpf_lsm.c | 2 +- kernel/bpf/devmap.c | 8 +- kernel/bpf/local_storage.c | 2 +- kernel/bpf/verifier.c | 3 + kernel/cgroup/rdma.c | 2 +- kernel/events/uprobes.c | 10 +- kernel/fork.c | 11 +- kernel/module.c | 4 +- kernel/padata.c | 136 ++----- kernel/params.c | 46 +-- kernel/taskstats.c | 1 + kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 92 +++-- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 ++- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/af_bluetooth.c | 10 +- net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_core.c | 34 +- net/bluetooth/hci_event.c | 3 - net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 9 + net/bpf/test_run.c | 20 +- net/bridge/br_multicast.c | 27 +- net/bridge/netfilter/Kconfig | 13 + net/bridge/netfilter/Makefile | 2 +- net/bridge/netfilter/ebtable_broute.c | 14 +- net/bridge/netfilter/ebtable_filter.c | 14 +- net/bridge/netfilter/ebtable_nat.c | 12 +- net/bridge/netfilter/ebtables.c | 71 ++-- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/auth.c | 4 +- net/ceph/crush/crush.c | 6 +- net/ceph/mon_client.c | 2 + net/ceph/osdmap.c | 14 +- net/core/filter.c | 17 +- net/core/flow_dissector.c | 79 +++- net/core/rtnetlink.c | 1 + net/ethtool/bitset.c | 8 +- net/ipv4/icmp.c | 12 +- net/ipv4/inet_connection_sock.c | 5 +- net/ipv4/netfilter/Kconfig | 59 ++- net/ipv4/netfilter/Makefile | 2 +- net/ipv4/netfilter/arp_tables.c | 43 ++- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/netfilter/arptable_filter.c | 14 +- net/ipv4/netfilter/ip_tables.c | 18 +- net/ipv4/netfilter/iptable_filter.c | 4 +- net/ipv4/netfilter/iptable_mangle.c | 4 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 4 +- net/ipv4/netfilter/iptable_security.c | 4 +- net/ipv4/nexthop.c | 4 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 --- net/ipv4/tcp.c | 3 +- net/ipv4/udp_tunnel_core.c | 48 +++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 ---- net/ipv6/ip6_udp_tunnel.c | 69 ++++ net/ipv6/netfilter/Kconfig | 30 +- net/ipv6/netfilter/Makefile | 2 +- net/ipv6/netfilter/ip6_tables.c | 18 +- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/netfilter/ip6table_filter.c | 4 +- net/ipv6/netfilter/ip6table_mangle.c | 4 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 4 +- net/ipv6/netfilter/ip6table_security.c | 4 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 4 +- net/mptcp/pm_netlink.c | 2 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/Kconfig | 22 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 152 ++++++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nf_queue.c | 4 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 +-- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_dynset.c | 10 +- net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo.c | 20 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/x_tables.c | 116 +++++- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/netfilter/xt_socket.c | 23 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 9 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 8 +- net/sched/cls_u32.c | 13 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 28 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_gred.c | 3 - net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 57 ++- net/sched/sch_pie.c | 52 ++- net/sched/sch_red.c | 34 +- net/sched/sch_sfb.c | 54 +-- net/sched/sch_taprio.c | 238 ++++++------ net/sctp/inqueue.c | 1 + net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/sunrpc/sysfs.c | 60 +-- net/sunrpc/xprtsock.c | 33 +- net/tipc/msg.c | 14 +- net/tls/tls_sw.c | 26 +- net/unix/diag.c | 21 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 3 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 4 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - security/integrity/ima/ima_crypto.c | 2 +- sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 7 - sound/core/control.c | 4 + sound/core/control_led.c | 14 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/isa/sc6000.c | 285 ++++++++------- sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_conexant.c | 35 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++++-- sound/soc/fsl/fsl_xcvr.c | 22 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 39 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 88 ++++- sound/usb/midi.c | 22 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/quirks.c | 38 +- sound/usb/stream.c | 4 +- tools/lib/bpf/relo_core.c | 2 + tools/perf/util/branch.h | 3 + tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 51 +-- tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 37 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- .../testing/selftests/mqueue/{setting => settings} | 0 virt/kvm/dirty_ring.c | 3 +- 692 files changed, 6912 insertions(+), 3309 deletions(-)

3 weeks

[PATCH 5.10 000/589] 5.10.258-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.258 release. There are 589 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.258-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.258-rc1 Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Ben Hutchings <benh(a)debian.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Kees Cook <keescook(a)chromium.org> selftests: lib.mk: Also install "config" and "settings" Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Alexandre Belloni <alexandre.belloni(a)bootlin.com> alarmtimer: Check RTC features instead of ops Alexandre Belloni <alexandre.belloni(a)bootlin.com> rtc: allow rtc_read_alarm without read_alarm callback Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Qingqing Yang <qingqing.yang(a)broadcom.com> flow_dissector: Do not count vlan tags inside tunnel payload Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Yannick Vignon <yannick.vignon(a)nxp.com> net/sched: taprio: Fix init procedure Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: choke: remove unused variables in struct choke_sched_data Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> net: sched: sch_netem: Refactor code in 4-state loss generator Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() Enze Li <lienze(a)kylinos.cn> scsi: sr: Add memory allocation failure handling for get_capabilities() Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Qu Wenruo <wqu(a)suse.com> btrfs: merge PAGE_CLEAR_DIRTY and PAGE_SET_WRITEBACK to PAGE_START_WRITEBACK Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Alexandre Belloni <alexandre.belloni(a)bootlin.com> rtc: introduce features bitfield Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: gred/red: remove unused variables in struct red_stats Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Wojciech Drewek <wojciech.drewek(a)intel.com> flow_dissector: Add PPPoE dissectors Boris Sukholitko <boris.sukholitko(a)broadcom.com> flow_dissector: Add number of vlan tags dissector Boris Sukholitko <boris.sukholitko(a)broadcom.com> dissector: do not set invalid PPP protocol Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: replace safety precautions with comments Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: stop going through private ops for dequeue and peek Yannick Vignon <yannick.vignon(a)nxp.com> net: taprio offload: enforce qdisc to netdev queue mapping Kurt Kanzenbach <kurt(a)linutronix.de> taprio: Handle short intervals and large packets Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Ido Schimmel <idosch(a)nvidia.com> nexthop: Emit a notification when a nexthop group is modified Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices наб <nabijaczleweli(a)nabijaczleweli.xyz> tty: hvc: remove HVC_IUCV_MAGIC Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix precedence bug in convert_bpf_ld_abs alignment check Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Sumit Semwal <sumit.semwal(a)linaro.org> arm64: dts: qcom: sdm845-xiaomi-beryllium: Add DSI and panel bits Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Takashi Iwai <tiwai(a)suse.de> ALSA: compress: Drop unused functions Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Arend van Spriel <arend.vanspriel(a)broadcom.com> brcmfmac: support chipsets with different core enumeration space Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix backport of io_poll_add() changes Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Sasha Levin <sashal(a)kernel.org> Revert "riscv: Sparse-Memory/vmemmap out-of-bounds fix" Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix connections leak when tlink setup failed David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Sasha Levin <sashal(a)kernel.org> Revert "scsi: ufs: core: Improve SCSI abort handling" Jamie Iles <quic_jiles(a)quicinc.com> i3c: fix uninitialized variable use in i2c setup Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Nathan Chancellor <nathan(a)kernel.org> drm/amd/display: Do not add '-mhard-float' to calcs, dsc, and dcn30 FP files for clang Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Martin Kepplinger <martink(a)posteo.de> arm64: dts: imx8mq-librem5: set regulators boot-on Guido Günther <agx(a)sigxcpu.org> arm64: dts: imx8mq-librem5: Don't mark buck3 as always on Martin Kepplinger <martink(a)posteo.de> arm64: dts: imx8mq-librem5-r3: workaround i2c1 issue with 1GHz cpu voltage Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write hongnanli <hongnan.li(a)linux.alibaba.com> fs/ocfs2: fix comments mentioning i_mutex Oleg Nesterov <oleg(a)redhat.com> x86/uprobes: Fix XOL allocation failure for 32-bit tasks David Gow <davidgow(a)google.com> drivers: base: Free devm resources when unregistering a device Keith Busch <kbusch(a)kernel.org> blk-mq: use quiesced elevator switch when reinitializing queues Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Joonwon Kang <joonwonkang(a)google.com> mailbox: Prevent out-of-bounds access in of_mbox_index_xlate() Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Leonid Ravich <lravich(a)gmail.com> IB/mad: Don't call to function that might sleep while in atomic context Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Improve SCSI abort handling Chengfeng Ye <cyeaa(a)connect.ust.hk> ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Waiman Long <longman(a)redhat.com> blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Lee, Chun-Yi <joeyli.kernel(a)gmail.com> thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Yongzhi Liu <lyz_cs(a)pku.edu.cn> drm/amd/display: Fix memory leak Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Alex Hung <alex.hung(a)amd.com> drm/amd/display: Add null checker before passing variables Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Liu Jian <liujian56(a)huawei.com> bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> net/sched: act_ct: fix ref leak when switching zones Arun Easi <aeasi(a)marvell.com> scsi: qla2xxx: Fix crash when I/O abort times out Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix warning message due to adisc being flushed Cezar Bulinaru <cbulinaru(a)gmail.com> net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Allow extra entities Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> ACPI: property: Constify stubs for CONFIG_ACPI=n case Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Peng Li <lipeng321(a)huawei.com> net: lapbether: replace comparison to NULL with "lapbeth_get_x25_dev" Peng Li <lipeng321(a)huawei.com> net: lapbether: remove trailing whitespaces Xie He <xie.he.0141(a)gmail.com> net: lapbether: Close the LAPB device before its underlying Ethernet device closes Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning ------------- Diffstat: Documentation/vm/hugetlbfs_reserv.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-integrator/integrator_cp.c | 13 +- .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 6 + arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 16 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 72 ++++ arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 299 ++++++++++++++--- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 20 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/riscv/include/asm/pgtable.h | 2 +- arch/s390/kernel/debug.c | 8 + arch/um/drivers/cow_user.c | 8 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/svm/nested.c | 11 + arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 10 + arch/x86/kvm/x86.c | 14 +- block/blk-cgroup.c | 4 + block/blk-mq.c | 6 +- block/blk.h | 3 +- block/elevator.c | 4 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 26 ++ drivers/base/dd.c | 12 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/bluetooth/hci_ldisc.c | 51 ++- drivers/cdrom/cdrom.c | 73 ++-- drivers/char/ipmi/ipmi_si_intf.c | 70 +++- drivers/char/ipmi/ipmi_ssif.c | 74 +++- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/mxs-dma.c | 1 + drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 72 +++- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++++ .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 3 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- drivers/gpu/drm/amd/display/dc/dcn30/Makefile | 4 +- drivers/gpu/drm/amd/display/dc/dsc/Makefile | 3 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i3c/master.c | 7 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/core/mad.c | 5 - drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/iommu/intel/iommu.c | 3 + drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/mailbox/mailbox-test.c | 39 ++- drivers/mailbox/mailbox.c | 9 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 111 ++++-- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/raid10.c | 2 + drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +-- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_driver.c | 81 +++-- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/media/usb/uvc/uvcvideo.h | 9 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/net/bareudp.c | 24 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 15 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 1 - drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/hamradio/6pack.c | 39 ++- drivers/net/netdevsim/dev.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 ++- drivers/net/tap.c | 23 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/lan78xx.c | 31 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 23 +- drivers/net/wireless/ath/ath11k/hal.c | 14 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 31 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.h | 5 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 +- .../net/wireless/broadcom/brcm80211/include/soc.h | 2 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/target/core.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 10 +- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/pci.c | 48 ++- drivers/pci/pcie/aer.c | 2 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/platform/x86/dell_rbu.c | 6 +- drivers/platform/x86/intel-hid.c | 6 +- drivers/platform/x86/surfacepro3_button.c | 1 + drivers/power/supply/max17042_battery.c | 2 +- drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/class.c | 5 + drivers/rtc/interface.c | 12 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/qla2xxx/qla_init.c | 20 +- drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 25 +- drivers/scsi/sr.h | 1 - drivers/soc/qcom/ocmem.c | 7 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/ti/omap_prm.c | 1 + drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- .../intel/int340x_thermal/int3400_thermal.c | 9 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 11 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/btrfs/extent_io.c | 4 +- fs/btrfs/extent_io.h | 12 +- fs/btrfs/inode.c | 30 +- fs/ceph/xattr.c | 1 + fs/cifs/cifs_spnego.c | 16 + fs/cifs/connect.c | 17 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 4 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 6 +- fs/gfs2/glops.c | 4 + fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/aops.c | 75 +++-- fs/ocfs2/cluster/nodemanager.c | 2 +- fs/ocfs2/dir.c | 4 +- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/file.c | 4 +- fs/ocfs2/inode.c | 33 +- fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/localalloc.c | 6 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/namei.c | 2 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 6 +- fs/omfs/inode.c | 6 + fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 ++- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/linux/acpi.h | 6 +- include/linux/cdrom.h | 1 + include/linux/dev_printk.h | 10 + include/linux/device.h | 48 ++- include/linux/dmi.h | 5 + include/linux/fsnotify_backend.h | 1 + include/linux/kvm_host.h | 3 +- include/linux/padata.h | 4 - include/linux/ppp_defs.h | 30 ++ include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/rtc.h | 2 + include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/tpm_eventlog.h | 9 +- include/linux/uprobes.h | 1 + include/linux/usb.h | 3 +- include/net/flow_dissector.h | 22 ++ include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/pie.h | 2 +- include/net/red.h | 1 - include/net/route.h | 6 - include/net/udp_tunnel.h | 15 + include/sound/compress_driver.h | 2 - include/trace/events/btrfs.h | 9 +- include/trace/events/ib_mad.h | 13 +- include/trace/events/rxrpc.h | 8 + include/uapi/linux/rtc.h | 5 + include/video/udlfb.h | 1 + io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 35 +- kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/local_storage.c | 2 +- kernel/cgroup/rdma.c | 2 +- kernel/events/uprobes.c | 10 +- kernel/padata.c | 136 ++------ kernel/taskstats.c | 1 + kernel/time/alarmtimer.c | 2 +- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 92 +++-- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 +++- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_event.c | 3 - net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 9 + net/bpf/test_run.c | 20 +- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/crush/crush.c | 6 +- net/ceph/osdmap.c | 14 +- net/core/filter.c | 2 +- net/core/flow_dissector.c | 79 ++++- net/core/rtnetlink.c | 1 + net/ethtool/bitset.c | 8 +- net/ipv4/netfilter/arp_tables.c | 18 +- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/nexthop.c | 36 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 --- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_bpf.c | 3 + net/ipv4/udp_tunnel_core.c | 48 +++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 ---- net/ipv6/ip6_udp_tunnel.c | 69 ++++ net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tx.c | 4 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 152 +++++++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 ++- net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo.c | 21 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 12 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 23 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 28 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_gred.c | 3 - net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 57 +++- net/sched/sch_pie.c | 52 ++- net/sched/sch_red.c | 34 +- net/sched/sch_sfb.c | 54 +-- net/sched/sch_taprio.c | 371 +++++++++++---------- net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/tipc/msg.c | 14 +- net/tls/tls_sw.c | 26 +- net/unix/diag.c | 21 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 3 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 4 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - security/integrity/ima/ima_crypto.c | 2 +- sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 75 ----- sound/core/control.c | 4 + sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++++-- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 39 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/clock.c | 6 + sound/usb/format.c | 2 +- sound/usb/midi.c | 12 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/stream.c | 4 +- tools/perf/util/branch.h | 3 + tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 35 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- tools/testing/selftests/lib.mk | 1 + .../testing/selftests/mqueue/{setting => settings} | 0 514 files changed, 4832 insertions(+), 2163 deletions(-)

3 weeks

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage June 2026