Lkft-triage June 2026

lkft-triage@lists.linaro.org

29 participants
18 discussions

[PATCH 5.10 000/342] 5.10.259-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.259 release. There are 342 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.259-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.259-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Easwar Hariharan <eahariha(a)linux.microsoft.com> arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Justin Stitt <justinstitt(a)google.com> octeontx2-af: replace deprecated strncpy with strscpy Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Add validation for lmac type Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Yajun Deng <yajun.deng(a)linux.dev> net: Remove redundant if statements Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Joe Thornber <ejt(a)redhat.com> dm btree: improve btree residency Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory John 'Warthog9' Hawley (VMware) <warthog9(a)eaglescrag.net> ktest: Fixing indentation to match expected pattern Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Zqiang <qiang.zhang(a)linux.dev> usbnet: Fix using smp_processor_id() in preemptible code warnings Eric Dumazet <edumazet(a)google.com> bonding: limit BOND_MODE_8023AD to Ethernet devices Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Nikola Z. Ivanov <zlatistiv(a)gmail.com> team: Move team device type change at the end of team_port_add Dong Chenchen <dongchenchen2(a)huawei.com> page_pool: Fix use-after-free in page_pool_recycle_in_ring Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> Bluetooth: hci_core: Fix use-after-free in vhci_flush() Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix race condition in send error reporting Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> nfc: llcp: protect nfc_llcp_sock_unlink() calls Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org> phy: renesas: rcar-gen3-usb2: Fix the use of msleep during spinlock Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Chengfeng Ye <cyeaa(a)connect.ust.hk> ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 48 +++ Makefile | 4 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++ arch/arm64/include/asm/cputype.h | 10 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 ++- arch/arm64/kernel/cpu_errata.c | 34 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +- arch/arm64/mm/mmu.c | 36 +- arch/x86/kernel/cpu/amd.c | 18 +- arch/x86/kernel/cpu/microcode/intel.c | 2 +- crypto/testmgr.c | 4 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 +- drivers/char/random.c | 4 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/fsi/fsi-sbefifo.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 6 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/hid/hid-core.c | 29 +- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-tegra.c | 53 +-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/npcm_adc.c | 26 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 ++ drivers/infiniband/core/verbs.c | 37 -- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 1 + drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/keyboard/atkbd.c | 15 + drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/persistent-data/dm-btree.c | 451 +++++++++++++++++++-- .../md/persistent-data/dm-transaction-manager.c | 9 + .../md/persistent-data/dm-transaction-manager.h | 10 +- drivers/media/rc/igorplugusb.c | 17 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 75 ++-- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 11 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 20 +- drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/team/team.c | 23 +- drivers/net/tun.c | 5 +- drivers/net/usb/usbnet.c | 2 + drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +- drivers/phy/tegra/xusb-tegra186.c | 38 +- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/sg.c | 2 +- drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-qup.c | 165 ++++---- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 10 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 11 +- drivers/spi/spi-topcliff-pch.c | 7 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/comedi/drivers/comedi_test.c | 5 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 +++-- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 +- drivers/tty/serial/dz.c | 58 +-- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 75 ++-- drivers/tty/serial/samsung_tty.c | 103 +++-- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 +- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/gadget.c | 12 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 + drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/function/f_hid.c | 20 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 ++-- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 13 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 12 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 1 + fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/dir.c | 30 +- fs/ext4/extents.c | 15 + fs/f2fs/data.c | 4 +- fs/f2fs/inline.c | 13 +- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hfsplus/bfind.c | 51 +++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 6 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++ include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/hci_core.h | 2 + include/net/bluetooth/l2cap.h | 1 + include/net/ip_vs.h | 3 +- include/net/netfilter/nf_queue.h | 1 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 23 -- include/rdma/ib_verbs.h | 47 --- include/rdma/iter.h | 80 ++++ io_uring/io_uring.c | 4 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 5 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 +++- net/batman-adv/bat_v_ogm.c | 59 +-- net/batman-adv/bridge_loop_avoidance.c | 63 ++- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/gateway_client.c | 3 +- net/batman-adv/main.c | 1 + net/batman-adv/multicast.c | 9 +- net/batman-adv/originator.c | 12 +- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 198 ++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 44 +- net/batman-adv/tvlv.c | 28 +- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 56 ++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 +++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_core.c | 34 +- net/bluetooth/hci_event.c | 18 +- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++- net/bluetooth/l2cap_sock.c | 86 ++-- net/bluetooth/mgmt.c | 12 +- net/bluetooth/rfcomm/sock.c | 48 ++- net/bluetooth/sco.c | 19 +- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++ net/can/raw.c | 8 +- net/core/dev.c | 6 +- net/core/drop_monitor.c | 6 +- net/core/dst.c | 6 +- net/core/filter.c | 17 +- net/core/neighbour.c | 15 +- net/core/page_pool.c | 41 +- net/core/skbuff.c | 10 +- net/ethtool/netlink.c | 6 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ieee802154/nl-phy.c | 3 +- net/ieee802154/nl802154.c | 3 +- net/ieee802154/socket.c | 3 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/route.c | 3 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 2 +- net/ipv6/addrconf.c | 6 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 4 +- net/ipv6/ip6_vti.c | 25 +- net/ipv6/ip6mr.c | 3 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 3 +- net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/mac80211/tdls.c | 2 +- net/mptcp/pm_netlink.c | 8 + net/mptcp/protocol.c | 22 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_queue.c | 28 +- net/netfilter/nf_synproxy_core.c | 26 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 36 +- net/netlink/af_netlink.c | 11 +- net/netrom/nr_loopback.c | 3 +- net/netrom/nr_route.c | 3 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 12 +- net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 40 +- net/phonet/af_phonet.c | 3 +- net/phonet/pn_dev.c | 6 +- net/phonet/socket.c | 3 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++---- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/act_mirred.c | 6 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 -- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/smc/smc_pnet.c | 3 +- net/socket.c | 23 +- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/wireless/nl80211.c | 16 +- net/wireless/scan.c | 3 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 +- security/keys/keyctl.c | 4 +- sound/aoa/codecs/onyx.c | 104 ++--- sound/aoa/codecs/tas.c | 113 ++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 +++---- sound/core/misc.c | 14 +- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/intel/boards/bytcht_es8316.c | 29 +- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +- sound/usb/clock.c | 6 + tools/testing/ktest/ktest.pl | 196 +++++---- tools/testing/selftests/net/forwarding/lib.sh | 56 +++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 442 files changed, 4423 insertions(+), 2404 deletions(-)

3 months, 2 weeks

[PATCH 5.15 000/411] 5.15.210-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.210 release. There are 411 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.210-rc1 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function Ben Hutchings <benh(a)debian.org> apparmor: validate default DFA states are in bounds Ben Hutchings <benh(a)debian.org> fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter Paolo Abeni <pabeni(a)redhat.com> mptcp: close TOCTOU race while computing rcv_wnd Will Deacon <will(a)kernel.org> arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Premium definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add C1-Ultra definitions Shanker Donthineni <sdonthineni(a)nvidia.com> arm64: cputype: Add NVIDIA Olympus definitions Christian Göttsche <cgzones(a)googlemail.com> selinux: enable genfscon labeling for securityfs Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Eric Biggers <ebiggers(a)kernel.org> ksmbd: Compare MACs in constant time Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Tejun Heo <tj(a)kernel.org> blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init Julian Anastasov <ja(a)ssi.bg> ipvs: skip ipv6 extension headers for csum checks Yin Tirui <yintirui(a)huawei.com> mm/huge_memory: update file PMD counter before folio_put() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/umem: Fix truncation for block sizes >= 4G Leon Romanovsky <leon(a)kernel.org> RDMA: Move DMA block iterator logic into dedicated files Randy Dunlap <rdunlap(a)infradead.org> RDMA/umem: fix kernel-doc warnings Anton Leontev <leontyevantony(a)gmail.com> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf Davide Ornaghi <d.ornaghi97(a)gmail.com> netfilter: nft_fib: fix stale stack leak via the OIFNAME register Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: align #define values Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> tty: serial: qcom-geni-serial: remove unused symbols Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Michael Kelley <mikelley(a)microsoft.com> drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() John Keeping <john(a)metanate.com> usb: gadget: f_hid: tidy error handling in hidg_alloc Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: use u32 for register interactions Thomas Gleixner <tglx(a)linutronix.de> serial: samsung_tty: Use port lock wrappers Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Fix per-pad high-speed termination calibration Wayne Chang <waynec(a)nvidia.com> phy: tegra: xusb: Disable trk clk when not in use Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Johan Hovold <johan(a)kernel.org> spi: qup: fix error pointer deref after DMA setup failure Yang Yingliang <yangyingliang(a)huawei.com> spi: qup: switch to use modern name Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Sam Daly <sam(a)samdaly.ie> octeontx2-af: CGX: add bounds check to cgx_speed_mbps index Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Al Viro <viro(a)zeniv.linux.org.uk> use less confusing names for iov_iter direction initializers Justin Iurman <justin.iurman(a)gmail.com> ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Eric Dumazet <edumazet(a)google.com> ipv6/addrconf: annotate data-races around devconf fields (II) Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Jiexun Wang <wangjiexun2025(a)gmail.com> Bluetooth: serialize accept_q access Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Init sk_peer_* on bt_sock_alloc Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Consolidate code around sk_alloc into a helper function Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> qed: Use the bitmap API to simplify some functions Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require net admin for CIFS SWN netlink Ido Schimmel <idosch(a)nvidia.com> genetlink: Use internal flags for multicast groups Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Piyush Sachdeva <s.piyush1024(a)gmail.com> smb: client: Use FullSessionKey for AES-256 encryption key derivation Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: topcliff-pch: Convert to platform remove callback returning void Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Christoph Hellwig <hch(a)lst.de> sd: rename the scsi_disk.dev field Luis Chamberlain <mcgrof(a)kernel.org> scsi: sd: Add error handling support for add_disk() Bart Van Assche <bvanassche(a)acm.org> scsi: core: pm: Rely on the device driver core for async power management Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Julia Lawall <Julia.Lawall(a)inria.fr> can: ucan: fix typos in comments Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Vignesh Viswanathan <quic_viswanat(a)quicinc.com> net: qrtr: ns: Change servers radix tree to xarray Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Tom Yan <tom.ty89(a)gmail.com> nvme: fix interpretation of DMRSL Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix the out-of-bounds nameoff handling for trailing dirents Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Jimmy Hon <honyuenkwun(a)gmail.com> rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: call folio_test_lru() after folio_get() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Limit XDomain response copy to actual frame size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Clamp XDomain response data copy to allocation size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Bound root directory content to block size Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Reject zero-length property entries in validator Wyatt Feng <bronzed_45_vested(a)icloud.com> sctp: stream: fully roll back denied add-stream state Zhao Zhang <zzhan461(a)ucr.edu> sctp: diag: reject stale associations in dump_one path Jisheng Zhang <jszhang(a)kernel.org> mmc: sdhci: add signal voltage switch in sdhci_resume_host Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Kamal Dasu <kamal.dasu(a)broadcom.com> mmc: core: Fix host controller programming for fixed driver type Yuqi Xu <xuyq21(a)lenovo.com> net: rds: clear i_sends on setup unwind Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> net: mv643xx: fix OF node refcount ZhaoJinming <zhaojinming(a)uniontech.com> net: bonding: fix NULL pointer dereference in bond_do_ioctl() Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context Yilin Zhu <zylzyl2333(a)gmail.com> ipc/shm: serialize orphan cleanup with shm_nattch updates Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Zeyu WANG <zeyu.thomas.wang(a)gmail.com> Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) Akhil R <akhilrajeev(a)nvidia.com> i2c: tegra: Fix NOIRQ suspend/resume Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: fix timing computation ignoring i2c-analog-filter Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() Jann Horn <jannh(a)google.com> fuse: reject fuse_notify() pagecache ops on directories Christian Brauner <brauner(a)kernel.org> pidfd: refuse access to tasks that have started exiting harder Michael Bommarito <michael.bommarito(a)gmail.com> IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Raf Dickson <rafdog35(a)gmail.com> vsock/vmci: fix sk_ack_backlog leak on failed handshake Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: check timestamping ret value Paolo Abeni <pabeni(a)redhat.com> mptcp: fix retransmission loop when csum is enabled Karl Mehltretter <kmehltretter(a)gmail.com> ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O Yuho Choi <dbgh9129(a)gmail.com> ARM: socfpga: Fix OF node refcount leak in SMP setup Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/srp: bound SRP_RSP sense copy by the received length Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Fix UAF at snd_timer_user_params() HyeongJun An <sammiee5311(a)gmail.com> USB: serial: kl5kusb105: fix bulk-out buffer overflow Jack Wu <jackbb_wu(a)compal.com> USB: serial: option: add usb-id for Dell Wireless DW5826e-m Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() Adrian Korwel <adriank20047(a)gmail.com> USB: serial: io_ti: fix heap overflow in get_manuf_info() Wyatt Feng <bronzed_45_vested(a)icloud.com> xfrm: espintcp: do not reuse an in-progress partial send Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix phys BO pread/pwrite with offset Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Tristan Madani <tristan(a)talencesecurity.com> netfilter: nft_tunnel: fix use-after-free on object destroy Alexander A. Klimov <grandmaster(a)al2klimov.de> drm/vc4: fix krealloc() memory leak Til Kaiser <mail(a)tk154.de> net: mvpp2: build skb from XDP-adjusted data on XDP_PASS Til Kaiser <mail(a)tk154.de> net: mvpp2: refill RX buffers before XDP or skb use Lorenzo Bianconi <lorenzo(a)kernel.org> net: mvpp2: Add metadata support for xdp mode Til Kaiser <mail(a)tk154.de> net: mvpp2: limit XDP frame size to the RX buffer Til Kaiser <mail(a)tk154.de> net: mvpp2: sync RX data at the hardware packet offset Florian Westphal <fw(a)strlen.de> netfilter: nft_exthdr: fix register tracking for F_PRESENT flag Xiang Mei <xmei5(a)asu.edu> netfilter: nf_log: validate MAC header was set before dumping it Kyle Zeng <kylebot(a)openai.com> netfilter: x_tables: avoid leaking percpu counter pointers Breno Leitao <leitao(a)debian.org> rds: mark snapshot pages dirty in rds_info_getsockopt() Eric Dumazet <edumazet(a)google.com> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() Weiming Shi <bestswngs(a)gmail.com> net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion Kyle Zeng <kylebot(a)openai.com> net: guard timestamp cmsgs to real error queue skbs Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix uninit-value in __sctp_rcv_asconf_lookup() Adrian Moreno <amorenoz(a)redhat.com> net: openvswitch: fix possible kfree_skb of ERR_PTR Kyle Zeng <kylebot(a)openai.com> ipv6: sit: reload inner IPv6 header after GSO offloads Mingyu Wang <25181214217(a)stu.xidian.edu.cn> net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove Chenguang Zhao <zhaochenguang(a)kylinos.cn> netlabel: validate unlabeled address and mask attribute lengths Sanghyun Park <sanghyun.park.cnu(a)gmail.com> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VPIPT I-cache handling Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Jeff Layton <jlayton(a)kernel.org> nfsd: don't ignore the return code of svc_proc_register() Edward Lo <loyuantsung(a)gmail.com> fs/ntfs3: Return error for inconsistent extended attributes Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> time: Fix off-by-one in settimeofday() usec validation Aleksandr Nogikh <nogikh(a)google.com> signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() Xin Long <lucien.xin(a)gmail.com> sctp: purge outqueue on stale COOKIE-ECHO handling Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr Eric Dumazet <edumazet(a)google.com> ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet <edumazet(a)google.com> ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options Bharath Reddy <kbreddy.rpbc(a)gmail.com> Bluetooth: fix memory leak in error path of hci_alloc_dev() Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: bnep: reject short frames before parsing Dudu Lu <phx0fer(a)gmail.com> Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: RFCOMM: validate skb length in MCC handlers Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: MGMT: validate advertising TLV before type checks Zhang Cen <rollkingzzc(a)gmail.com> Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() David Thompson <davthompson(a)nvidia.com> net: lan743x: permit VLAN-tagged packets up to configured MTU Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> net: garp: fix unsigned integer underflow in garp_pdu_parse_attr Oscar Maes <oscmaes92(a)gmail.com> pcnet32: stop holding device spin lock during napi_complete_done Yicong Hui <yiconghui(a)gmail.com> drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix off-by-one in multicast context address compression Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: use RCU with deferred freeing for action lifecycle Guangshuo Li <lgs201920130244(a)gmail.com> dm cache policy smq: check allocation under invalidate lock Yiming Qian <yimingqian591(a)gmail.com> netfilter: bridge: make ebt_snat ARP rewrite writable Florian Westphal <fw(a)strlen.de> netfilter: conntrack_irc: fix possible out-of-bounds read Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: synproxy: add mutex to guard hook reference counting Julian Anastasov <ja(a)ssi.bg> ipvs: clear the svc scheduler ptr early on edit Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: xt_NFQUEUE: prefer raw_smp_processor_id Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> tee: optee: prevent use-after-free when the client exits before the supplicant Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Nathan Chancellor <nathan(a)kernel.org> compiler-clang.h: Add __diag infrastructure for clang Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Kuniyuki Iwashima <kuniyu(a)google.com> bpf: Free reuseport cBPF prog after RCU grace period. Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix SuperSpeed root hub wMaxPacketSize Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Stefan Metzmacher <metze(a)samba.org> smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Harini Katakam <harini.katakam(a)amd.com> phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table Jiasheng Jiang <jiashengjiangcool(a)gmail.com> RDMA/rxe: Fix double free in rxe_srq_from_init Ben Hutchings <benh(a)debian.org> Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Duoming Zhou <duoming(a)zju.edu.cn> wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: lib: Add helpers for checksum handling Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Carlos Eduardo Gallo Filho <gcarlos(a)disroot.org> drm: Remove plane hsub/vsub alignment requirement for core helpers Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/arm64/silicon-errata.rst | 46 ++++++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 ++++++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/kvm_mmu.h | 4 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 55 +++++-- arch/arm64/kernel/cpu_errata.c | 34 +++- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---- arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-- arch/arm64/mm/mmu.c | 36 +++-- arch/x86/kernel/cpu/amd.c | 18 ++- arch/x86/kernel/cpu/microcode/intel.c | 4 +- block/blk-cgroup.c | 32 ++-- crypto/testmgr.c | 4 +- drivers/base/power/domain.c | 10 +- drivers/block/drbd/drbd_main.c | 2 +- drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/loop.c | 14 +- drivers/block/nbd.c | 10 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 33 ++-- drivers/char/random.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 47 +++--- drivers/crypto/nx/nx-842.h | 24 +-- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/dma/idxd/init.c | 1 - drivers/dma/idxd/sysfs.c | 1 + drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpio/gpio-rockchip.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++--- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++---- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 +++- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/hid/hid-core.c | 29 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi.c | 2 +- drivers/hid/wacom_sys.c | 19 ++- drivers/hid/wacom_wac.h | 1 + drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +++--- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++++---- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 8 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++++ drivers/infiniband/core/verbs.c | 38 ----- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 3 - drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++- drivers/input/keyboard/atkbd.c | 15 ++ drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 ++- drivers/isdn/mISDN/l1oip_core.c | 2 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/rc/igorplugusb.c | 17 +- drivers/media/rc/ttusbir.c | 13 +- drivers/misc/fastrpc.c | 77 ++++++--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +- drivers/mmc/host/sdhci.c | 1 + drivers/mtd/spi-nor/sst.c | 13 ++ drivers/net/bonding/bond_main.c | 10 +- drivers/net/can/usb/ucan.c | 6 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++---- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 9 +- drivers/net/phy/mscc/mscc_main.c | 38 +---- drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +-- .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 + drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nfc/nxp-nci/i2c.c | 21 ++- drivers/nvme/host/core.c | 8 +- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/tcp.c | 4 +- drivers/nvme/target/io-cmd-file.c | 4 +- drivers/nvme/target/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/phy/tegra/xusb-tegra186.c | 38 +++-- drivers/phy/tegra/xusb.h | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/hosts.c | 1 + drivers/scsi/scsi.c | 8 - drivers/scsi/scsi_pm.c | 44 +---- drivers/scsi/scsi_priv.h | 4 +- drivers/scsi/scsi_scan.c | 17 ++ drivers/scsi/scsi_sysfs.c | 1 + drivers/scsi/scsi_transport_fc.c | 77 ++++----- drivers/scsi/sd.c | 30 ++-- drivers/scsi/sd.h | 9 +- drivers/scsi/sg.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 3 - drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-qup.c | 165 +++++++++---------- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 9 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 15 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-uniphier.c | 8 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/staging/greybus/hid.c | 2 +- drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_util.c | 4 +- drivers/target/target_core_file.c | 2 +- drivers/tee/optee/supp.c | 107 ++++++++---- drivers/thermal/thermal_core.c | 7 +- drivers/thunderbolt/property.c | 38 +++-- drivers/thunderbolt/xdomain.c | 6 +- drivers/tty/serial/altera_jtaguart.c | 18 ++- drivers/tty/serial/dz.c | 58 ++++--- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 ++- drivers/tty/serial/qcom_geni_serial.c | 75 ++++----- drivers/tty/serial/samsung_tty.c | 88 +++++----- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 40 ++--- drivers/tty/serial/zs.h | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/dwc3/dwc3-xilinx.c | 20 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 20 +-- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 76 +++++---- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 ++- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/io_ti.c | 11 ++ drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +-- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/usbip_common.c | 2 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/vhost/net.c | 6 +- drivers/vhost/scsi.c | 10 +- drivers/vhost/vhost.c | 6 +- drivers/vhost/vringh.c | 4 +- drivers/vhost/vsock.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++-- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/vt8500lcdfb.c | 2 +- drivers/xen/pvcalls-back.c | 8 +- fs/9p/vfs_addr.c | 4 +- fs/9p/vfs_dir.c | 2 +- fs/9p/xattr.c | 4 +- fs/afs/cmservice.c | 2 +- fs/afs/dir.c | 2 +- fs/afs/file.c | 4 +- fs/afs/internal.h | 4 +- fs/afs/rxrpc.c | 10 +- fs/afs/write.c | 4 +- fs/aio.c | 4 +- fs/btrfs/inode.c | 2 + fs/btrfs/ioctl.c | 5 +- fs/ceph/addr.c | 2 +- fs/ceph/dir.c | 6 +- fs/ceph/file.c | 4 +- fs/cifs/cifsacl.c | 129 +++++++++++++-- fs/cifs/connect.c | 6 +- fs/cifs/file.c | 4 +- fs/cifs/ioctl.c | 2 +- fs/cifs/netlink.c | 6 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2transport.c | 36 +++-- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 30 ++-- fs/ext4/extents.c | 15 ++ fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/inline.c | 13 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 20 ++- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/fuse/ioctl.c | 4 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/hpfs/alloc.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/smb2pdu.c | 5 +- fs/ksmbd/smbacl.c | 17 +- fs/ksmbd/transport_tcp.c | 4 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 9 +- fs/nfsd/state.h | 17 +- fs/nfsd/stats.c | 4 +- fs/nfsd/stats.h | 2 +- fs/nfsd/vfs.c | 4 +- fs/ntfs3/xattr.c | 1 + fs/ocfs2/cluster/tcp.c | 2 +- fs/orangefs/inode.c | 8 +- fs/read_write.c | 12 +- fs/seq_file.c | 2 +- fs/splice.c | 10 +- fs/udf/super.c | 4 +- include/drm/drm_dp_helper.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/compat.h | 4 + include/linux/compiler-clang.h | 28 ++++ include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/fb.h | 4 +- include/linux/hid.h | 15 +- include/linux/parport.h | 1 + include/linux/printk.h | 13 ++ include/linux/randomize_kstack.h | 44 ++++- include/linux/sched.h | 4 + include/linux/syscalls.h | 4 + include/linux/uio.h | 3 + include/net/act_api.h | 1 + include/net/bluetooth/bluetooth.h | 3 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/ip_vs.h | 3 +- include/net/mctp.h | 3 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 36 +---- include/rdma/ib_verbs.h | 48 ------ include/rdma/iter.h | 88 ++++++++++ init/main.c | 1 - io_uring/io_uring.c | 2 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/fork.c | 2 + kernel/pid.c | 8 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/debugobjects.c | 2 +- lib/mpi/mpicoder.c | 2 +- mm/damon/vaddr.c | 4 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 1 + mm/madvise.c | 2 +- mm/page_io.c | 2 +- mm/process_vm_access.c | 2 +- net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 ++ net/9p/client.c | 2 +- net/batman-adv/bat_iv_ogm.c | 82 ++++++++-- net/batman-adv/bat_v_ogm.c | 59 ++++--- net/batman-adv/bridge_loop_avoidance.c | 57 ++++--- net/batman-adv/main.c | 1 + net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 109 +++++++++---- net/batman-adv/tp_meter.h | 1 + net/batman-adv/translation-table.c | 35 +++- net/batman-adv/tvlv.c | 28 +++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 46 +++++- net/bluetooth/6lowpan.c | 4 +- net/bluetooth/a2mp.c | 2 +- net/bluetooth/af_bluetooth.c | 144 ++++++++++++++--- net/bluetooth/bnep/core.c | 50 ++++-- net/bluetooth/bnep/sock.c | 10 +- net/bluetooth/hci_event.c | 18 ++- net/bluetooth/hci_sock.c | 10 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/hidp/sock.c | 10 +- net/bluetooth/l2cap_core.c | 87 +++++++++- net/bluetooth/l2cap_sock.c | 86 +++++----- net/bluetooth/mgmt.c | 20 ++- net/bluetooth/rfcomm/core.c | 69 +++++--- net/bluetooth/rfcomm/sock.c | 48 ++++-- net/bluetooth/sco.c | 19 ++- net/bluetooth/smp.c | 2 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 ++-- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++++ net/ceph/messenger_v1.c | 4 +- net/ceph/messenger_v2.c | 14 +- net/compat.c | 2 +- net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 10 +- net/ethtool/eeprom.c | 5 +- net/hsr/hsr_framereg.c | 6 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 31 ++-- net/ipv4/esp4.c | 4 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 47 +++--- net/ipv6/ah6.c | 29 ++-- net/ipv6/datagram.c | 54 ++++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 28 +++- net/ipv6/ioam6.c | 12 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 ++- net/ipv6/mcast.c | 22 +-- net/ipv6/ndisc.c | 12 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/ipv6/tcp_ipv6.c | 5 +- net/iucv/af_iucv.c | 20 ++- net/key/af_key.c | 6 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 9 +- net/mptcp/options.c | 29 ++-- net/mptcp/pm.c | 34 +++- net/mptcp/pm_netlink.c | 31 +++- net/mptcp/protocol.c | 26 ++- net/mptcp/sockopt.c | 8 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_synproxy_core.c | 26 ++- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 ++-- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 ++ net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 ++ net/openvswitch/datapath.c | 1 + net/packet/af_packet.c | 25 +-- net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/qrtr/ns.c | 180 ++++++++------------- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ----- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 4 +- net/smc/smc_clc.c | 6 +- net/socket.c | 23 +-- net/sunrpc/socklib.c | 6 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprtsock.c | 6 +- net/tipc/topsrv.c | 2 +- net/tls/tls_device.c | 4 +- net/vmw_vsock/vmci_transport.c | 4 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 35 ++-- net/xfrm/xfrm_user.c | 5 +- security/apparmor/policy_unpack.c | 27 ++-- security/keys/keyctl.c | 4 +- security/selinux/hooks.c | 3 +- sound/aoa/codecs/onyx.c | 104 ++++-------- sound/aoa/codecs/tas.c | 113 +++++-------- sound/aoa/core/gpio-feature.c | 20 +-- sound/aoa/core/gpio-pmf.c | 26 ++- sound/aoa/soundbus/i2sbus/core.c | 3 + sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++-------- sound/core/misc.c | 14 +- sound/core/timer.c | 1 + sound/drivers/aloop.c | 40 +++-- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--- tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- 491 files changed, 4845 insertions(+), 2652 deletions(-)

3 months, 2 weeks

[PATCH 6.12 000/307] 6.12.93-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.93 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:47 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.93-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.93-rc1 Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Liu Ye <liuye(a)kylinos.cn> mm/memfd: fix spelling and grammatical issues Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: perform all memfd seal checks in a single place Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Ingo Molnar <mingo(a)kernel.org> x86/alternatives: Rename 'apply_relocation()' to 'text_poke_apply_relocation()' Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: chemical: scd30: Use guard(mutex) to allow early returns SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently Paolo Abeni <pabeni(a)redhat.com> mptcp: introduce the mptcp_init_skb helper Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Flush and stop persistent ring buffer on panic Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> ice: fix VF queue configuration with low MTU values Li Xiasong <lixiasong1(a)huawei.com> mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Michael Bommarito <michael.bommarito(a)gmail.com> net: hsr: defer node table free until after RCU readers Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery Alistair Popple <apopple(a)nvidia.com> mm/memory: fix spurious warning when unmapping device-private/exclusive pages Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: scarlett2: Allow flash writes ending at segment boundary Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Brian Gerst <brgerst(a)gmail.com> x86/boot: Disable stack protector for early boot code Tushar Dave <tdave(a)nvidia.com> iommu: Skip PASID validation for devices without PASID capability Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Will Deacon <will(a)kernel.org> arm64: io: Extract user memory type in ioremap_prot() Will Deacon <will(a)kernel.org> arm64: io: Rename ioremap_prot() to __ioremap_prot() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Suraj Kandpal <suraj.kandpal(a)intel.com> drm/dp: Add eDP 1.5 bit definition Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Nathan Chancellor <nathan(a)kernel.org> HID: core: Fix size_t specifier in hid_report_raw_event() Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Vicki Pfau <vi(a)endrift.com> HID: core: Add printk_ratelimited variants to hid_warn() etc Jakub Kicinski <kuba(a)kernel.org> inet: frags: flush pending skbs in fqdir_pre_exit() Jakub Kicinski <kuba(a)kernel.org> inet: frags: add inet_frag_queue_flush() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mm/page_alloc: clear page->private in free_pages_prepare() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid double decrement of bla.num_requests Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: avoid empty VLAN responses Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: directly shut down timer on cleanup Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid role confusion in tp_list Sven Eckelmann <sven(a)narfation.org> batman-adv: iv: recover OGM scheduling after forward packet error Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: reject oversized TVLV packets Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: abort OGM send on tvlv append failure Sven Eckelmann <sven(a)narfation.org> batman-adv: v: stop OGMv2 on disabled interface Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Al Viro <viro(a)zeniv.linux.org.uk> remove pointless includes of <linux/fdtable.h> Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Eric Dumazet <edumazet(a)google.com> net/sched: act_mirred: add loop detection Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net/sched: act_mirred: Move the recursion counter struct netdev_xmit Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add support for writing firmware blocks using EPL payload Danielle Ratson <danieller(a)nvidia.com> net: ethtool: Add new parameters and a function to support EPL Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: always unmask interrupts in el0_softstp() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove debug exception registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split bkpt32 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split brk64 exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware watchpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split single stepping exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: refactor reinstall_suspended_bps() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: split hardware breakpoint exception entry Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: entry: Add entry and exit functions for debug exceptions Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: remove break/step handler registration infrastructure Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call step handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: call software breakpoint handlers statically Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: refactor aarch32_break_handler() Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: debug: clean up single_step_handler logic Mostafa Saleh <smostafa(a)google.com> arm64: Introduce esr_is_ubsan_brk() Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Release indirect CSD GEM reference on CPU job free Maíra Canal <mcanal(a)igalia.com> drm/v3d: Fix use-after-free of CPU job query arrays on error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/alpha/include/asm/Kbuild | 1 + arch/arc/include/asm/Kbuild | 1 + arch/arm/include/asm/Kbuild | 1 + arch/arm64/include/asm/debug-monitors.h | 34 +-- arch/arm64/include/asm/esr.h | 5 + arch/arm64/include/asm/exception.h | 14 +- arch/arm64/include/asm/io.h | 24 +- arch/arm64/include/asm/kgdb.h | 12 + arch/arm64/include/asm/kprobes.h | 8 + arch/arm64/include/asm/ring_buffer.h | 10 + arch/arm64/include/asm/system_misc.h | 4 - arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/traps.h | 6 + arch/arm64/include/asm/uprobes.h | 11 + arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 258 ++++++++------------- arch/arm64/kernel/entry-common.c | 148 +++++++++++- arch/arm64/kernel/hw_breakpoint.c | 60 ++--- arch/arm64/kernel/kgdb.c | 39 +--- arch/arm64/kernel/probes/kprobes.c | 31 +-- arch/arm64/kernel/probes/kprobes_trampoline.S | 2 +- arch/arm64/kernel/probes/uprobes.c | 24 +- arch/arm64/kernel/traps.c | 80 +------ arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/fault.c | 75 ------ arch/arm64/mm/ioremap.c | 7 +- arch/csky/include/asm/Kbuild | 1 + arch/hexagon/include/asm/Kbuild | 1 + arch/loongarch/include/asm/Kbuild | 1 + arch/m68k/include/asm/Kbuild | 1 + arch/microblaze/include/asm/Kbuild | 1 + arch/mips/dec/platform.c | 109 ++++++++- arch/mips/include/asm/Kbuild | 1 + arch/nios2/include/asm/Kbuild | 1 + arch/openrisc/include/asm/Kbuild | 1 + arch/parisc/include/asm/Kbuild | 1 + arch/powerpc/include/asm/Kbuild | 1 + arch/riscv/include/asm/Kbuild | 1 + arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/s390/include/asm/Kbuild | 1 + arch/sh/include/asm/Kbuild | 1 + arch/sparc/include/asm/Kbuild | 1 + arch/um/include/asm/Kbuild | 1 + arch/x86/include/asm/Kbuild | 1 + arch/x86/include/asm/text-patching.h | 2 +- arch/x86/kernel/Makefile | 16 ++ arch/x86/kernel/alternative.c | 6 +- arch/x86/kernel/callthunks.c | 6 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 ++- arch/x86/kvm/svm/sev.c | 68 ++++-- arch/x86/mm/Makefile | 2 + arch/xtensa/include/asm/Kbuild | 1 + drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 ++- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++-- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 34 ++- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 ++- drivers/gpu/drm/v3d/v3d_sched.c | 16 +- drivers/gpu/drm/v3d/v3d_submit.c | 22 +- drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-core.c | 62 ++++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 54 ++++- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 +++--- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/iommu/iommu.c | 25 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 +++--- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 36 +-- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 +++--- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++++------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++++---------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 ++- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 5 + drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++---- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/fcntl.c | 1 - fs/file_table.c | 1 - fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 5 - fs/notify/fanotify/fanotify.c | 1 - fs/notify/fanotify/fanotify_user.c | 1 - fs/overlayfs/copy_up.c | 1 - fs/proc/base.c | 1 - fs/smb/server/smbacl.c | 8 +- include/asm-generic/ring_buffer.h | 13 ++ include/drm/display/drm_dp.h | 1 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 17 +- include/linux/hid_bpf.h | 14 +- include/linux/memfd.h | 23 +- include/linux/mm.h | 55 ----- include/linux/netdevice_xmit.h | 10 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/inet_frag.h | 18 +- include/net/ipv6_frag.h | 9 +- include/net/xfrm.h | 3 +- io_uring/io_uring.c | 1 - ipc/util.c | 2 +- kernel/bpf/bpf_inode_storage.c | 1 - kernel/bpf/bpf_task_storage.c | 1 - kernel/bpf/token.c | 1 - kernel/events/core.c | 16 +- kernel/exit.c | 1 - kernel/fork.c | 11 +- kernel/module/dups.c | 1 - kernel/module/kmod.c | 1 - kernel/trace/ring_buffer.c | 22 ++ kernel/umh.c | 1 - lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memfd.c | 56 ++++- mm/memory.c | 2 +- mm/mmap.c | 12 +- mm/page_alloc.c | 1 + mm/shmem.c | 6 - net/batman-adv/bat_iv_ogm.c | 82 +++++-- net/batman-adv/bat_v_ogm.c | 59 +++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++-- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 +++--- net/batman-adv/translation-table.c | 57 ++++- net/batman-adv/tvlv.c | 28 ++- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 +++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_sync.c | 12 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 +++- net/ethtool/cmis.h | 20 +- net/ethtool/cmis_cdb.c | 103 ++++++-- net/ethtool/cmis_fw_update.c | 214 ++++++++++++----- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 26 +-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 3 +- net/ethtool/strset.c | 2 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 22 +- net/handshake/request.c | 64 +++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 6 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 51 +++- net/ipv4/ip_fragment.c | 18 +- net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 +- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/pm.c | 40 +++- net/mptcp/pm_netlink.c | 16 +- net/mptcp/protocol.c | 92 +++++--- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +-- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 ++++-- net/rxrpc/rxkad.c | 115 ++++----- net/sched/act_mirred.c | 77 ++++-- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 47 +--- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 ++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/apparmor/domain.c | 1 - sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 14 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 38 ++- tools/testing/cxl/test/cxl.c | 105 ++++----- tools/testing/selftests/mm/hmm-tests.c | 50 ++++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 382 files changed, 3974 insertions(+), 2279 deletions(-)

3 months, 3 weeks

[PATCH 7.0 000/332] 7.0.12-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.12 release. There are 332 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.12-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.12-rc1 Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Saurav Sachidanand <sauravsc(a)amazon.com> i2c: tegra: make tegra_i2c_mutex_unlock() return void Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X Fernando Antunez Antonio <fer.antunez24antonio(a)gmail.com> ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Lorenzo Stoakes <ljs(a)kernel.org> Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix amdgpu_hmm_range_get_pages Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Pranay Samala <pranay.samala(a)intel.com> drm/i915/color: Fix HDR pre-CSC LUT programming loop Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Guangshuo Li <lgs201920130244(a)gmail.com> uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hang Cao <caohang(a)eswincomputing.com> dt-bindings: usb: Fix EIC7700 USB reset's issue Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir David Carlier <devnexen(a)gmail.com> dma-buf: fix UAF in dma_buf_fd() tracepoint Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Michael Bommarito <michael.bommarito(a)gmail.com> octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Shuvam Pandey <shuvampandey1(a)gmail.com> iio: adc: nxp-sar-adc: zero-initialize dma_slave_config Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: nxp-sar-adc: Avoid division by zero Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: nxp-sar-adc: fix division by zero in write_raw Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix lockdep false positive by removing unneeded lock Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: fix deadlock on shared proxy's parent removal Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: undo the vote of the proxy on GPIO free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Richard Chang <richardycc(a)google.com> zram: fix use-after-free in zram_writeback_endio Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Sunny Patel <nueralspacetech(a)gmail.com> mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: do not trigger BUG() on BH disabled context Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Fernando Fernandez Mancera <fmancera(a)suse.de> Revert "ipv6: preserve insertion order for same-scope addresses" Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Frank Wunderlich <frank-w(a)public-files.de> net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work Ivan Vecera <ivecera(a)redhat.com> dpll: export __dpll_device_change_ntf() for use under dpll_lock Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: add die temperature reporting for supported chips Ivan Vecera <ivecera(a)redhat.com> dpll: zl3073x: detect DPLL channel count from chip ID at runtime Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Victor Nogueira <victor(a)mojatatu.com> net/sched: act_mirred: Fix return code in early mirred redirect error paths Kito Xu (veritas501) <hxzene(a)gmail.com> net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop Jamal Hadi Salim <jhs(a)mojatatu.com> net: Introduce skb tc depth field to track packet loops Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fix packet loop on netem when duplicate is on Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Michał Grzelak <michal.grzelak(a)intel.com> drm/i915/aux: use polling when irqs are unavailable Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Dan Carpenter <error27(a)gmail.com> accel/ivpu: prevent uninitialized data bug in debugfs Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Fix system name string leaks Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() Ewan D. Milne <emilne(a)redhat.com> scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tap: free page on error paths in tap_get_user_xdp() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable e521588 <alessandro.schino(a)sbb.ch> esp: fix page frag reference leak on skb_to_sgvec failure Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: button: Fix ACPI GPE handler leak during removal Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: .../devicetree/bindings/usb/eswin,eic7700-usb.yaml | 7 +- Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- block/blk-mq.c | 2 +- drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/acpi/acpica/evxfgpe.c | 50 ++++- drivers/acpi/button.c | 24 ++- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/block/zram/zram_drv.c | 6 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/dma-buf/dma-buf.c | 6 +- drivers/dpll/dpll_netlink.c | 13 +- drivers/dpll/zl3073x/core.c | 116 +++-------- drivers/dpll/zl3073x/core.h | 59 +++--- drivers/dpll/zl3073x/dpll.c | 52 +++-- drivers/dpll/zl3073x/dpll.h | 4 +- drivers/dpll/zl3073x/i2c.c | 37 ++-- drivers/dpll/zl3073x/regs.h | 2 + drivers/dpll/zl3073x/spi.c | 37 ++-- drivers/gpib/cb7210/cb7210.c | 10 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-shared-proxy.c | 9 + drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpio/gpiolib-shared.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_color.c | 2 +- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dp_aux.c | 20 +- drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 69 +++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/i2c/busses/i2c-tegra.c | 15 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/nxp-sar-adc.c | 24 ++- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/rc/igorplugusb.c | 2 +- drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 6 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_rep.c | 8 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/pcs/pcs-mtk-lynxi.c | 3 + drivers/net/phy/micrel.c | 15 +- drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_debug.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/uio/uio_pci_generic_sva.c | 7 +- drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 75 ++++--- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/hugetlbfs/inode.c | 46 ++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/acpi/acpixf.h | 5 + include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/dpll.h | 1 + include/linux/hid.h | 2 - include/linux/hugetlb.h | 8 +- include/linux/hugetlb_inline.h | 12 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/skbuff.h | 2 + include/linux/syscalls.h | 4 + include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/hugetlb.c | 75 +++---- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/migrate_device.c | 4 +- mm/rmap.c | 2 + mm/vmalloc.c | 2 +- net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 10 +- net/handshake/handshake.h | 6 +- net/handshake/netlink.c | 29 ++- net/handshake/request.c | 81 ++++++-- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 16 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 16 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 7 +- net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 5 +- net/rxrpc/rxgk.c | 98 +++------ net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 92 +-------- net/rxrpc/rxkad.c | 29 +-- net/sched/act_mirred.c | 77 +++++--- net/sched/sch_netem.c | 47 +---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 28 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 12 +- sound/hda/codecs/side-codecs/cs35l56_hda.c | 17 +- sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/ioam6.sh | 2 +- 316 files changed, 3289 insertions(+), 1907 deletions(-)

3 months, 3 weeks

[PATCH 6.18 000/315] 6.18.35-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.35 release. There are 315 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.35-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Jassi Brar <jassisinghbrar(a)gmail.com> mailbox: Fix NULL message support in mbox_send_message() Wei-Cheng Chen <weichengc(a)nvidia.com> xhci: tegra: Fix ghost USB device on dual-role port unplug Robert Marko <robert.marko(a)sartura.hr> net: phy: micrel: fix LAN8814 QSGMII soft reset Qing Wang <wangqing7171(a)gmail.com> mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Add support for guarded PMBus lock Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix memory corruption with small endpoints Johan Hovold <johan(a)kernel.org> USB: serial: cypress_m8: fix memory corruption with small endpoint Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: xilinx: fix error handling in zynqmp init error paths Shaomin Chen <eeesssooo020(a)gmail.com> xfrm: iptfs: reset runtime state when cloning SAs Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() Paolo Abeni <pabeni(a)redhat.com> mptcp: reset rcv wnd on disconnect Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup fallback dummy mapping generation Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: avoid double free of pool->stack on AQ init failure Zeng Heng <zengheng4(a)huawei.com> arm64: tlb: Flush walk cache when unsharing PMD tables Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: do not drop partial packets Paolo Abeni <pabeni(a)redhat.com> mptcp: borrow forward memory from subflow Paolo Abeni <pabeni(a)redhat.com> mptcp: handle first subflow closing consistently David Carlier <devnexen(a)gmail.com> net: devmem: reject dma-buf bind with non-page-aligned size or SG length Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: drop nanoseconds width specifier Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Convert timeout from jiffies to ms Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Bluetooth: hci_qca: Migrate to serdev specific shutdown function Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> serdev: Provide a bustype shutdown function David Howells <dhowells(a)redhat.com> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer David Howells <dhowells(a)redhat.com> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg Tom Lendacky <thomas.lendacky(a)amd.com> x86/mm: Disable broadcast TLB flush when PCID is disabled Lukas Wunner <lukas(a)wunner.de> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Make driver_data info const David E. Box <david.e.box(a)linux.intel.com> platform/x86/intel/vsec: Refactor base_addr handling Jacques Nilo <jnilo(a)free.fr> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: 8250: dispatch SysRq character in serial8250_handle_irq() Jacques Nilo <jnilo(a)free.fr> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Switch to using channel reset Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Convert to use a platform device Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole handover lockup Maciej W. Rozycki <macro(a)orcam.me.uk> serial: dz: Fix bootconsole message clobbering at chip reset Ziyi Guo <n7l8m4(a)u.northwestern.edu> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Michael Bommarito <michael.bommarito(a)gmail.com> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO David Francis <David.Francis(a)amd.com> drm/amdkfd: Check for pdd drm file first in CRIU restore path Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Eric Huang <jinhuieric.huang(a)amd.com> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr Shitalkumar Gandhi <shital.gandhi45(a)gmail.com> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Maciej W. Rozycki <macro(a)orcam.me.uk> serial: zs: Fix swapped RI/DSR modem line transition counting Hongling Zeng <zenghongling(a)kylinos.cn> serial: sh-sci: fix memory region release in error path Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ Prasanna S <prasanna.s(a)oss.qualcomm.com> serial: qcom-geni: fix UART_RX_PAR_EN bit position Myeonghun Pak <mhun512(a)gmail.com> serial: altera_jtaguart: handle uart_add_one_port() failures Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/si: Disregard vblank time when no displays are connected Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix potential UAF in TTM object purge Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Zhenghang Xiao <kipreyyy(a)gmail.com> drm/gem: fix race between change_handle and handle_delete Berkant Koc <me(a)berkoc.com> drm/hyperv: validate VMBus packet size in receive callback Berkant Koc <me(a)berkoc.com> drm/hyperv: validate resolution_count and fix WIN8 fallback Alexandru Hossu <hossu.alexandru(a)gmail.com> scsi: target: iscsi: Validate CHAP_R length before base64 decode Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf Michael Bommarito <michael.bommarito(a)gmail.com> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Michael Bommarito <michael.bommarito(a)gmail.com> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 Michael Bommarito <michael.bommarito(a)gmail.com> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: serialize DMABUF cancel against request completion Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: f_fs: copy only received bytes on short ep0 read Seungjin Bae <eeodqql09(a)gmail.com> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports Jeremy Erazo <mendozayt13(a)gmail.com> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: f_hid: fix device reference leak in hidg_alloc() Guangshuo Li <lgs201920130244(a)gmail.com> usb: gadget: net2280: Fix double free in probe error path Kai Aizen <kai.aizen.dev(a)gmail.com> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind Johan Hovold <johan(a)kernel.org> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Johan Hovold <johan(a)kernel.org> USB: serial: mxuport: fix memory corruption with small endpoint Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: fix missing indat transfer sanity check Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: cypress_m8: validate interrupt packet headers Zhang Cen <rollkingzzc(a)gmail.com> USB: serial: belkin_sa: validate interrupt status length Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL Jan Volckaert <janvolck(a)gmail.com> USB: serial: option: add MeiG SRM813Q Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Don't update power_supply on power role change if not connected Myrrh Periwinkle <myrrhperiwinkle(a)qtmlabs.xyz> usb: typec: ucsi: Check if power role change actually happened before handling Sebastian Reichel <sebastian.reichel(a)collabora.com> usb: typec: tcpm: improve handling of DISCOVER_MODES failures Dan Carpenter <error27(a)gmail.com> usb: typec: tipd: Fix error code in tps6598x_probe() Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: check URB actual_length for interrupt-IN notifications Michael Bommarito <michael.bommarito(a)gmail.com> usbip: vudc: Fix use after free bug in vudc_remove due to race condition Sam Burkels <sam(a)1a38.nl> usb: storage: Add quirks for PNY Elite Portable SSD Stephen J. Fuhry <fuhrysteve(a)gmail.com> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers Wentao Liang <vulab(a)iscas.ac.cn> usb: musb: omap2430: Fix use-after-free in omap2430_probe() Michal Pecio <michal.pecio(a)gmail.com> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: convert ci_role_switch to local variable Tudor Ambarus <tudor.ambarus(a)linaro.org> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Zhaoyang Yu <2426767509(a)qq.com> tty: serial: pch_uart: add check for dma_alloc_coherent() Guangshuo Li <lgs201920130244(a)gmail.com> counter: Fix refcount leak in counter_alloc() error path Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Hongling Zeng <zenghongling(a)kylinos.cn> gpib: cb7210: Fix region leak when request_irq fails Nicolás Bazaes <contacto(a)bazaes.cl> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Xiaolei Wang <xiaolei.wang(a)windriver.com> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec Ali Ganiyev <ali.qaniyev(a)gmail.com> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Dmitriy Zharov <contact(a)zharov.dev> Input: xpad - add support for ASUS ROG RAIKIRI II Qbeliw Tanaka <q.tanaka(a)gmx.com> Input: xpad - add "Nova 2 Lite" from GameSir Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Jingguo Tan <tanjingguo(a)huawei.com> xfrm: esp: restore combined single-frag length gate Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: close stream only when running Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-motu: Protect register DSP event queue positions Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: use skb_to_full_sk in async output callbacks Herbert Xu <herbert(a)gondor.apana.org.au> xfrm: ipcomp: Free destination pages on acomp errors Maoyi Xie <maoyixie.tju(a)gmail.com> xfrm: route MIGRATE notifications to caller's netns Ashutosh Desai <ashutoshdesai993(a)gmail.com> nfc: hci: fix out-of-bounds read in HCP header parsing Arnd Bergmann <arnd(a)arndb.de> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings Lee Jones <lee(a)kernel.org> HID: wacom: Fix OOB write in wacom_hid_set_device_mode() Santhosh Kumar K <s-k6(a)ti.com> spi: spi-mem: avoid mutating op template in spi_mem_supports_op() Minh Nguyen <minhnguyen.080505(a)gmail.com> net: skbuff: fix missing zerocopy reference in pskb_carve helpers Kuniyuki Iwashima <kuniyu(a)google.com> ip6: vti: Use ip6_tnl.net in vti6_changelink(). Michael Bommarito <michael.bommarito(a)gmail.com> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname Zhengchuan Liang <zcliangcn(a)gmail.com> xfrm: input: hold netns during deferred transport reinjection Qi Tang <tpluszz77(a)gmail.com> ipv6: validate extension header length before copying to cmsg Maoyi Xie <maoyixie.tju(a)gmail.com> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). Zhengchuan Liang <zcliangcn(a)gmail.com> ipv6: exthdrs: refresh nh after handling HAO option Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Justin Iurman <justin.iurman(a)gmail.com> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() Junrui Luo <moonafterrain(a)outlook.com> macsec: fix replay protection at XPN lower-PN wrap Yuqi Xu <xuyq21(a)lenovo.com> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Jason A. Donenfeld <Jason(a)zx2c4.com> wireguard: send: append trailer after expanding head Alexis Lothoré (eBPF Foundation) <alexis.lothore(a)bootlin.com> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines Chaitanya Sabnis <chaitanya.msabnis(a)gmail.com> i2c: davinci: fix division by zero on missing clock-frequency Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: elan_i2c - validate firmware size before use Dan Carpenter <error27(a)gmail.com> usb: dwc2: Fix use after free in debug code Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Peter Chen <peter.chen(a)cixtech.com> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix request skipping after clearing halt Johan Hovold <johan(a)kernel.org> USB: serial: omninet: fix memory corruption with small endpoint Benoît Monin <benoit.monin(a)bootlin.com> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: fix use-after-free in error path Aldo Conte <aldocontelk(a)gmail.com> iio: light: cm3323: fix reg_conf not being initialized correctly Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: scd30: fix division by zero in write_raw Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: chemical: mhz19b: reject oversized serial replies Svyatoslav Ryhel <clamor95(a)gmail.com> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale Felix Gu <ustc.gu(a)gmail.com> iio: light: veml6070: Fix resource leak in probe error path Advait Dhamorikar <advaitd(a)mechasystems.com> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL Salah Triki <salah.triki(a)gmail.com> iio: temperature: tsys01: fix broken PROM checksum validation Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: ssp_sensors: cancel delayed work_refresh on remove Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: adis16260: fix division by zero in write_raw David Carlier <devnexen(a)gmail.com> iio: gyro: itg3200: fix i2c read into the wrong stack location Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad4695: Fix call ordering in offload buffer postenable Salah Triki <salah.triki(a)gmail.com> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw Salah Triki <salah.triki(a)gmail.com> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix powerdown control on dual-channel devices Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: acquire lock when doing powerdown control Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix input raw value check Rodrigo Alencar <rodrigo.alencar(a)analog.com> iio: dac: ad5686: fix ref bit initialization for single-channel parts Salah Triki <salah.triki(a)gmail.com> iio: dac: max5821: fix return value check in powerdown sync Kim Seer Paller <kimseer.paller(a)analog.com> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings David Carlier <devnexen(a)gmail.com> iio: adc: npcm: fix unbalanced clk_disable_unprepare() Christofer Jonason <christofer.jonason(a)guidelinegeo.com> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux Nathan Chancellor <nathan(a)kernel.org> Disable -Wattribute-alias for clang-23 and newer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Check PSC request indices against the actual size of the buffer Sean Christopherson <seanjc(a)google.com> KVM: SEV: Compute the correct max length of the in-GHCB scratch area Sean Christopherson <seanjc(a)google.com> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Sean Christopherson <seanjc(a)google.com> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Michael Roth <michael.roth(a)amd.com> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use Sean Christopherson <seanjc(a)google.com> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Qiang Ma <maqianga(a)uniontech.com> KVM: arm64: PMU: Preserve AArch32 counter low bits Mark Brown <broonie(a)kernel.org> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor Wentao Guan <guanwentao(a)uniontech.com> USB: cdc-acm: Fix bit overlap and move quirk definitions to header Alice Ryhl <aliceryhl(a)google.com> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Matthew Maurer <mmaurer(a)google.com> rust_binder: Avoid holding lock when dropping delivered_death Ben Hutchings <benh(a)debian.org> parport: Fix race between port and client registration Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: xpad - fix out-of-bounds access for Share button Doruk Tan Ozturk <doruk(a)0sec.ai> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: fix UAF in iso_recv_frame Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: HIDP: fix missing length checks in hidp_input_report() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Steve French <stfrench(a)microsoft.com> smb: client: fix uninitialized variable in smb2_writev_callback Stepan Ionichev <sozdayvek(a)gmail.com> auxdisplay: line-display: fix OOB read on zero-length message_store() Dev Jain <dev.jain(a)arm.com> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Pratyush Yadav (Google) <pratyush(a)kernel.org> memfd: deny writeable mappings when implying SEAL_WRITE Alexandre Ghiti <alex(a)ghiti.fr> mm: memcontrol: propagate NMI slab stats to memcg vmstats Linpu Yu <linpu5433(a)gmail.com> ipc: limit next_id allocation to the valid ID range SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() Mikulas Patocka <mpatocka(a)redhat.com> hpfs: fix a crash if hpfs_map_dnode_bitmap fails Shuai Zhang <shuai.zhang(a)oss.qualcomm.com> Bluetooth: btusb: Allow firmware re-download when version matches hlleng <a909204013(a)gmail.com> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse Thomas Fourier <fourier.thomas(a)gmail.com> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Henri A <contact(a)henrialfonso.com> media: rc: igorplugusb: fix control request setup packet Johan Hovold <johan(a)kernel.org> USB: serial: safe_serial: fix memory corruption with small endpoint Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: validate connector number in ucsi_connector_change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: altmodes/displayport: validate count before reading Status Update VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: ucsi: ccg: reject firmware images without a ':' record header Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: adis16550: fix stack leak in trigger handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Read Intel DPCD workaround register Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: Restore GFP_DMA for CHSC allocation Andrei Vagin <avagin(a)google.com> Revert "x86/fpu: Refine and simplify the magic number check during signal return" Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: fix inverted error logic Sean Young <sean(a)mess.org> media: rc: fix race between unregister and urb/irq callbacks Pavel Begunkov <asml.silence(a)gmail.com> net: skbuff: fix pskb_carve leaking zcopy pages Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in fib6_select_path() Jiayuan Chen <jiayuan.chen(a)linux.dev> ipv6: fix possible infinite loop in rt6_fill_node() Jingguo Tan <tanjingguo(a)huawei.com> vsock/virtio: bind uarg before filling zerocopy skb Zhenghang Xiao <kipreyyy(a)gmail.com> sctp: fix race between sctp_wait_for_connect and peeloff Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Skip redundant detach on already-detached port Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Add NULL guards in teardown path to prevent panic on attach failure Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: convert bank->clk to devm_clk_get_enabled() Dan Carpenter <error27(a)gmail.com> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: adnp: fix flow control regression caused by scoped_guard() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Heitor Alves de Siqueira <halves(a)igalia.com> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Zhenghang Xiao <kipreyyy(a)gmail.com> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Pass negative errno through handshake_complete() Chuck Lever <chuck.lever(a)oracle.com> nvme-tcp: store negative errno in queue->tls_err Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Use spin_lock_bh for hn_lock Jijie Shao <shaojijie(a)huawei.com> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" Rahul Chandelkar <rc(a)rexion.ai> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add more safeties to EEPROM Netlink fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback Jakub Kicinski <kuba(a)kernel.org> ethtool: strset: fix header attribute index in ethnl_req_get_phydev() Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure Jakub Kicinski <kuba(a)kernel.org> ethtool: tsinfo: fix uninitialized stats on the by-PHC path Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: pse-pd: fix missing ethnl_ops_complete() Jakub Kicinski <kuba(a)kernel.org> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error Jakub Kicinski <kuba(a)kernel.org> ethtool: tsconfig: fix reply error handling Jakub Kicinski <kuba(a)kernel.org> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in sysfs path Ido Schimmel <idosch(a)nvidia.com> bridge: Fix sleep in atomic context in netlink path Oliver Hartkopp <socketcan(a)hartkopp.net> bonding: refuse to enslave CAN devices Zhao Dongdong <zhaodongdong(a)kylinos.cn> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Balasubramani Vivekanandan <balasubramani.vivekanandan(a)intel.com> drm/xe: Restore IDLEDLY regiter on engine reset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: codecs: simple-mux: Fix enum control bounds check Sean Shen <grayhat(a)foxmail.com> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Eric Dumazet <edumazet(a)google.com> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() Eric Dumazet <edumazet(a)google.com> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() Eric Dumazet <edumazet(a)google.com> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Li Ming <ming.li(a)zohomail.com> cxl/test: Update mock dev array before calling platform_device_add() Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski <kuba(a)kernel.org> ethtool: cmis: require exact CDB reply length Jakub Kicinski <kuba(a)kernel.org> ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski <kuba(a)kernel.org> ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid racy updates to dev->ethtool bitfield Jakub Kicinski <kuba(a)kernel.org> ethtool: module: avoid leaking a netdev ref on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid device context leak on reply-build failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix hkey leak when indir_size is 0 Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: fix falsely ignoring indir table updates Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: add missing errno on RSS context delete Jakub Kicinski <kuba(a)kernel.org> ethtool: rss: avoid modifying the RSS context response Björn Töpel <bjorn(a)kernel.org> net: Avoid checksumming unreadable skb tail on trim Weiming Shi <bestswngs(a)gmail.com> net: team: fix NULL pointer dereference in team_xmit during mode change Marc Harvey <marcharvey(a)google.com> net: team: Rename port_disabled team mode op to port_tx_disabled Marc Harvey <marcharvey(a)google.com> net: team: Remove unused team_mode_op, port_enabled Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: mxc: fix irq_high handling Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix potential OOB access in supervision frame handling Prathamesh Deshpande <prathameshdeshpande7(a)gmail.com> net/mlx5: HWS: Reject unsupported remove-header action Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcm: oss: Fix setup list UAF on proc write error Eric Dumazet <edumazet(a)google.com> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() David Jeffery <djeffery(a)redhat.com> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues Breno Leitao <leitao(a)debian.org> net/iucv: fix locking in .getsockopt Alexandra Winter <wintera(a)linux.ibm.com> net/smc: Do not re-initialize smc hashtables Ilya Maximets <i.maximets(a)ovn.org> net: netlink: don't set nsid on local notifications Ilya Maximets <i.maximets(a)ovn.org> net: netlink: fix sending unassigned nsid after assigned one Ziyu Zhang <ziyuzhang201(a)gmail.com> vsock: keep poll shutdown state consistent Weiming Shi <bestswngs(a)gmail.com> tun: free page on build_skb failure in tun_xdp_one() Weiming Shi <bestswngs(a)gmail.com> tun: free page on short-frame rejection in tun_xdp_one() Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nf_tables: fix dst corruption in same register operation Florian Westphal <fw(a)strlen.de> netfilter: ebtables: fix OOB read in compat_mtw_from_user Florian Westphal <fw(a)strlen.de> netfilter: xt_cpu: prefer raw_smp_processor_id Chris Mason <clm(a)meta.com> netfilter: synproxy: refresh tcphdr after skb_ensure_writable Deepanshu Kartikey <kartikey406(a)gmail.com> kernel/fork: validate exit_signal in kernel_clone() Dhabaleshwar Das <dhabal123(a)gmail.com> accel/rocket: fix UAF via dangling GEM handle in create_bo Florian Schmaus <florian.schmaus(a)codasip.com> kunit: fix use-after-free in debugfs when using kunit.filter Liu Kai <lukace97(a)outlook.com> HID: remove duplicate hid_warn_ratelimited definition Hongtao Lee <lihongtao(a)kylinos.cn> tools/bootconfig: Fix buf leaks in apply_xbc Carl Lee <carl.lee(a)amd.com> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems David Ahern <dahern(a)nvidia.com> xfrm: Check for underflow in xfrm_state_mtu Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() Lee Jones <lee(a)kernel.org> nfc: llcp: Fix use-after-free in llcp_sock_release() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Victor Nogueria <victor(a)mojatatu.com> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked Usama Arif <usama.arif(a)linux.dev> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Jeremy Kerr <jk(a)codeconstruct.com.au> net: mctp: ensure our nlmsg responses are initialised Davide Caratti <dcaratti(a)redhat.com> net/sched: cls_fw: fix NULL dereference of "old" filters before change() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size ------------- Diffstat: Documentation/netlink/specs/handshake.yaml | 8 + Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +- arch/arm64/kvm/nested.c | 5 + arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/kvm/sys_regs.c | 11 +- arch/mips/dec/platform.c | 109 ++++++++++- arch/riscv/include/asm/syscall_wrapper.h | 4 + arch/x86/kernel/cpu/cpuid-deps.c | 1 + arch/x86/kernel/fpu/signal.c | 11 +- arch/x86/kernel/ftrace.c | 7 + arch/x86/kvm/svm/avic.c | 35 +++- arch/x86/kvm/svm/sev.c | 76 ++++--- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/android/binder/allocation.rs | 8 + drivers/android/binder/process.rs | 7 +- drivers/android/binder/transaction.rs | 11 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 42 ++-- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/cpufreq/intel_pstate.c | 13 +- drivers/gpio/gpio-adnp.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 23 ++- drivers/gpio/gpio-virtuser.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 3 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++ drivers/gpu/drm/i915/display/intel_psr.c | 60 ++++-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 13 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 7 + drivers/hwmon/pmbus/pmbus.h | 5 + drivers/hwmon/pmbus/pmbus_core.c | 8 + drivers/i2c/busses/i2c-davinci.c | 2 +- drivers/iio/adc/ad4695.c | 23 +-- drivers/iio/adc/mt6359-auxadc.c | 1 + drivers/iio/adc/npcm_adc.c | 25 +-- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/mhz19b.c | 17 ++ drivers/iio/chemical/scd30_core.c | 2 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad3530r.c | 54 +++-- drivers/iio/dac/ad5686.c | 56 ++++-- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/adis16550.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/inkern.c | 6 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/light/veml6070.c | 14 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/mailbox/mailbox.c | 15 +- drivers/mailbox/tegra-hsp.c | 2 +- drivers/md/bcache/super.c | 3 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/rp1/rp1_pci.c | 1 + drivers/net/bonding/bond_main.c | 6 + drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++--- drivers/net/macsec.c | 3 +- drivers/net/phy/micrel.c | 15 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +-- drivers/net/team/team_core.c | 51 +++-- drivers/net/team/team_mode_loadbalance.c | 4 +- drivers/net/tun.c | 5 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvme/host/tcp.c | 2 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 91 ++++----- drivers/s390/cio/chsc.c | 4 +- drivers/s390/cio/chsc_sch.c | 20 +- drivers/s390/cio/scm.c | 2 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 ++- drivers/scsi/scsi_transport_fc.c | 77 ++++---- drivers/spi/spi-mem.c | 15 +- drivers/staging/gpib/cb7210/cb7210.c | 10 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 5 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++-- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/thunderbolt/property.c | 32 ++- drivers/tty/serdev/core.c | 21 ++ drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 ++++++++-------- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 16 +- drivers/tty/serial/samsung_tty.c | 8 - drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 ++++++++------------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 ++ drivers/usb/core/config.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 27 +-- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 26 ++- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_uvc.c | 28 ++- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 ++++---- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 ++- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/mct_u232.c | 26 ++- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 9 +- drivers/usb/serial/safe_serial.c | 11 ++ drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/tcpm.c | 117 ++++++----- drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/tipd/core.c | 1 + drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 ++- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- fs/hpfs/alloc.c | 2 +- fs/smb/client/cifsacl.c | 116 ++++++++--- fs/smb/client/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.c | 11 ++ fs/smb/server/smbacl.c | 8 +- include/kunit/test.h | 1 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 ++ include/linux/compiler_types.h | 4 + include/linux/hid.h | 2 - include/linux/if_team.h | 3 +- include/linux/intel_vsec.h | 4 +- include/linux/mailbox_controller.h | 3 + include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/serial_core.h | 12 ++ include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/netfilter/nf_tables.h | 7 + include/net/xfrm.h | 3 +- ipc/util.c | 2 +- kernel/fork.c | 11 +- lib/debugobjects.c | 2 +- lib/kunit/executor.c | 19 +- lib/kunit/test.c | 1 + mm/damon/sysfs-schemes.c | 8 +- mm/memcontrol.c | 6 + mm/memfd.c | 12 +- mm/rmap.c | 2 + mm/slab_common.c | 2 + mm/slub.c | 1 + net/bluetooth/6lowpan.c | 2 + net/bluetooth/hci_conn.c | 4 +- net/bluetooth/hci_sync.c | 16 +- net/bluetooth/hidp/core.c | 23 ++- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 41 +++- net/bluetooth/l2cap_sock.c | 16 +- net/bridge/br_netlink.c | 17 +- net/bridge/br_switchdev.c | 1 - net/bridge/br_sysfs_if.c | 30 ++- net/bridge/netfilter/ebtables.c | 30 +++ net/core/devmem.c | 11 ++ net/core/filter.c | 2 +- net/core/skbuff.c | 45 ++++- net/ethtool/cmis.h | 4 +- net/ethtool/cmis_cdb.c | 9 +- net/ethtool/cmis_fw_update.c | 44 +++-- net/ethtool/coalesce.c | 6 + net/ethtool/eeprom.c | 10 +- net/ethtool/linkstate.c | 6 +- net/ethtool/module.c | 41 ++-- net/ethtool/netlink.c | 4 +- net/ethtool/netlink.h | 4 +- net/ethtool/pse-pd.c | 10 +- net/ethtool/rss.c | 37 ++-- net/ethtool/strset.c | 2 +- net/ethtool/tsconfig.c | 15 +- net/ethtool/tsinfo.c | 19 +- net/handshake/genl.c | 3 +- net/handshake/genl.h | 1 + net/handshake/handshake-test.c | 2 +- net/handshake/handshake.h | 4 +- net/handshake/netlink.c | 6 +- net/handshake/request.c | 16 +- net/handshake/tlshd.c | 6 +- net/hsr/hsr_forward.c | 4 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/ip_tunnel_core.c | 22 ++- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 6 +- net/ipv6/ip6_vti.c | 23 ++- net/ipv6/route.c | 5 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 6 +- net/l2tp/l2tp_core.c | 11 +- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/fastopen.c | 4 +- net/mptcp/mib.c | 1 - net/mptcp/mib.h | 1 - net/mptcp/protocol.c | 65 ++++-- net/mptcp/protocol.h | 31 ++- net/mptcp/subflow.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_synproxy_core.c | 2 + net/netfilter/nft_bitwise.c | 18 +- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/xt_cpu.c | 2 +- net/netlink/af_netlink.c | 11 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 ++ net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/rxrpc/ar-internal.h | 14 +- net/rxrpc/call_event.c | 22 +-- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 ++- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++++-- net/rxrpc/rxgk.c | 147 ++++++-------- net/rxrpc/rxgk_app.c | 46 ++--- net/rxrpc/rxgk_common.h | 66 +++---- net/rxrpc/rxkad.c | 115 ++++------- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 ---- net/sched/sch_sfb.c | 2 +- net/sctp/socket.c | 2 + net/smc/af_smc.c | 4 +- net/vmw_vsock/af_vsock.c | 49 +++-- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 26 ++- net/vmw_vsock/vmci_transport.c | 8 +- net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_ipcomp.c | 12 +- net/xfrm/xfrm_iptfs.c | 29 ++- net/xfrm/xfrm_policy.c | 17 +- net/xfrm/xfrm_state.c | 23 ++- net/xfrm/xfrm_user.c | 5 +- sound/core/oss/pcm_oss.c | 18 +- .../motu/motu-register-dsp-message-parser.c | 11 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 ++- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++-- sound/usb/mixer_scarlett2.c | 33 +++- tools/bootconfig/main.c | 4 +- tools/testing/cxl/test/cxl.c | 105 ++++------ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +- 346 files changed, 3284 insertions(+), 1733 deletions(-)

3 months, 4 weeks

[PATCH 6.1 000/969] 6.1.175-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.175 release. There are 969 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:39 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.175-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.175-rc1 Linus Torvalds <torvalds(a)linux-foundation.org> security/keys: fix missed RCU read section on lookup Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: validate rx_req_idx to prevent out-of-bounds array access Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Ido Schimmel <idosch(a)nvidia.com> bridge: mcast: Fix a possible use-after-free when removing a bridge port Petr Machata <petrm(a)nvidia.com> net: bridge: Flush multicast groups when snooping is disabled Guangshuo Li <lgs201920130244(a)gmail.com> RDMA/rtrs: Fix use-after-free in path file creation cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: hp_accel: Check ACPI_COMPANION() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: preserve VLAN tags on trapped link-local frames Arınç ÜNAL <arinc.unal(a)arinc9.com> net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: fix FDB entries not aging out with short timeout Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: sync driver-specific behavior of MT7531 variants Matthew Leach <matthew.leach(a)collabora.com> wifi: ath11k: fix peer resolution on rx path when peer_id=0 P Praneesh <quic_ppranees(a)quicinc.com> wifi: ath11k: fix rssi station dump not updated in QCN9074 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring hashmap Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: initialize hw_ops for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update hal srng regs for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: remap ce register space for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update ce configurations for IPQ5018 Sriram R <quic_srirrama(a)quicinc.com> wifi: ath11k: update hw params for IPQ5018 Youghandhar Chintala <quic_youghand(a)quicinc.com> wifi: ath11k: Trigger sta disconnect on hardware restart Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/snapshot: fix dumping of the unaligned regions Felix Gu <ustc.gu(a)gmail.com> spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Sayali Patil <sayalip(a)linux.ibm.com> powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() Mikko Perttunen <mperttunen(a)nvidia.com> drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/dsi: don't dump registers past the mapped region Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Xiang Mei <xmei5(a)asu.edu> net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Nicolas Escande <nico.escande(a)gmail.com> wifi: ath11k: fix error path leaks in some WMI WOW calls Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Jiayuan Chen <jiayuan.chen(a)linux.dev> irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Myeonghun Pak <mhun512(a)gmail.com> net: lan966x: avoid unregistering netdev on register failure Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Kuniyuki Iwashima <kuniyu(a)google.com> tcp: Fix imbalanced icsk_accept_queue count. Florian Westphal <fw(a)strlen.de> netfilter: bridge: eb_tables: close module init race Florian Westphal <fw(a)strlen.de> netfilter: x_tables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: move to two-stage removal scheme Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xtables_unregister_table_exit Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xt_unregister_table_pre_exit Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: Exclude LEGACY TABLES on PREEMPT_RT. Breno Leitao <leitao(a)debian.org> netfilter: Make legacy configs user selectable Kuniyuki Iwashima <kuniyu(a)amazon.com> netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c Florian Westphal <fw(a)strlen.de> netfilter: xtables: fix up kconfig dependencies Florian Westphal <fw(a)strlen.de> netfilter: ebtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: xtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arptables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: x_tables: unregister the templates first Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization Maulik Shah <maulik.shah(a)oss.qualcomm.com> pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Takashi Iwai <tiwai(a)suse.de> HID: uclogic: Fix regression of input name assignment Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate GPIO pin LUT table size before iterating Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Julien Chauveau <chauveau.julien(a)gmail.com> drm/bridge: it66121: acquire reset GPIO in probe Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: set fwnode->secondary to NULL in fwnode_init() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Remove unused code to avoid build warning Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe Michael Bommarito <michael.bommarito(a)gmail.com> KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails Zhihao Cheng <chengzhihao1(a)huawei.com> cifs: Fix busy dentry used after unmounting John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Marcin Szycik <marcin.szycik(a)intel.com> ice: fix setting promisc mode while adding VID filter Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: reset connection on receiving queue overflow Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Dawei Feng <dawei.feng(a)seu.edu.cn> qed: fix double free in qed_cxt_tables_alloc() Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Michael Bommarito <michael.bommarito(a)gmail.com> net: ifb: report ethtool stats over num_tx_queues Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: MGMT: validate Add Extended Advertising Data length Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name David Carlier <devnexen(a)gmail.com> Bluetooth: ISO: drop ISO_END frames received without prior ISO_START Safa Karakuş <safa.karakus(a)secunnix.com> Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> net: wwan: iosm: fix potential memory leaks in ipc_imem_init() Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Sasha Levin <sashal(a)kernel.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_lvds: fix hang on init failure Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915: skip __i915_request_skip() for already signaled requests Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Ye Bin <yebin10(a)huawei.com> smb/client: fix possible infinite loop and oob read in symlink_data() Qiang Ma <maqianga(a)uniontech.com> KVM: x86: Fix Xen hypercall tracepoint argument assignment Junrui Luo <moonafterrain(a)outlook.com> KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic Aaron Sacks <contact(a)xchglabs.com> KVM: Reject wrapped offset in kvm_reset_dirty_gfn() Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Li Xiasong <lixiasong1(a)huawei.com> netfilter: nf_conntrack_sip: get helper before allocating expectation Matt Vollrath <tactii(a)gmail.com> i40e: Cleanup PTP pins on probe failure Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Enable JFFS2 write buffer for S25FS256T Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix leaking free_bds Ryo Takakura <ryotkkr98(a)gmail.com> net: bcmgenet: Initialize u64 stats seq counter Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Liang Jie <liangjie(a)lixiang.com> smb: client: correctly handle ErrorContextData as a flexible array Paolo Abeni <pabeni(a)redhat.com> net/sched: cls_flower: revert unintended changes Jakub Kicinski <kuba(a)kernel.org> net: tls: fix strparser anchor skb leak on offload RX setup failure Petr Oros <poros(a)redhat.com> ice: fix NULL pointer dereference in ice_reset_all_vfs() Jacob Keller <jacob.e.keller(a)intel.com> ice: Pull common tasks into ice_vf_post_vsi_rebuild Petr Oros <poros(a)redhat.com> iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler Petr Oros <poros(a)redhat.com> iavf: wait for PF confirmation before removing VLAN filters Petr Oros <poros(a)redhat.com> iavf: stop removing VLAN filters from PF on interface down Petr Oros <poros(a)redhat.com> iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Jones Syue 薛懷宗 <jonessyue(a)qnap.com> bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex: Prevent lockup in requeue-PI during signal/ timeout wakeup wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Fix missing error check for jack detection wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 Oldherl Oh <me(a)oldherl.one> ALSA: hda/conexant: fix some typos Breno Leitao <leitao(a)debian.org> netconsole: propagate device name truncation in dev_name_store() Matthew Wood <thepacketgeek(a)gmail.com> net: netconsole: move newline trimming to function Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. William A. Kennington III <william(a)wkennington.com> net: mctp i2c: check length before marking flow active Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams Florian Westphal <fw(a)strlen.de> neigh: let neigh_xmit take skb ownership Eric Dumazet <edumazet(a)google.com> neighbour: add RCU protection to neigh_tables[] Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix slot delay calculation overflow Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() John Madieu <john.madieu(a)gmail.com> spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ Yang Yingliang <yangyingliang(a)huawei.com> spi: rockchip: switch to use modern name Lizhe <sensor1010(a)163.com> drivers/spi-rockchip.c : Remove redundant variable slave Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd3.1: Don't validate the firmware when already validated Alexandre Demers <alexandre.f.demers(a)gmail.com> drm/amdgpu: fix spelling typos Keith Busch <kbusch(a)kernel.org> nvme-pci: fix missed admin queue sq doorbell write Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Maurizio Lombardi <mlombard(a)redhat.com> nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Mieczyslaw Nalewaj <namiltd(a)yahoo.com> net: dsa: realtek: rtl8365mb: fix mode mask calculation Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: scope conn->binding slowpath to bound sessions only DaeMyung Kang <charsyam(a)gmail.com> ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->dsack_dups Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->bytes_retrans Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->bytes_sent Eric Dumazet <edumazet(a)google.com> tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans Eric Dumazet <edumazet(a)google.com> tcp: preserve const qualifier in tcp_sk() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> container_of: add container_of_const() that preserves const-ness of the pointer Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> container_of: remove container_of_safe() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/wm: Verify the correct plane DDB entry Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> drm/i915: Loop over all active pipes in intel_mbus_dbox_update Gustavo Sousa <gustavo.sousa(a)intel.com> drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Constify watermark state checker Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> f2fs: Use sysfs_emit_at() to simplify code Brian Masney <bmasney(a)redhat.com> clk: visconti: pll: initialize clk_init_data to zero Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for PCIe power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for USB power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Add missing GDSCs Val Packett <val(a)packett.cool> dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Pengpeng Hou <pengpeng(a)iscas.ac.cn> platform/x86: dell-wmi-sysman: bound enumeration string aggregation Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Pengpeng Hou <pengpeng(a)iscas.ac.cn> fs/ntfs3: terminate the cached volume label after UTF-8 conversion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices Chen Ni <nichen(a)iscas.ac.cn> leds: lgm-sso: Remove duplicate assignments for priv->mmap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Billy Tsai <billy_tsai(a)aspeedtech.com> i3c: mipi-i3c-hci: fix IBI payload length calculation for final status Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Mike Leach <mike.leach(a)arm.com> perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: Avoid returning positive values to user space Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cy8c95x0: remove duplicate error message Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Puranjay Mohan <puranjay(a)kernel.org> bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT Yihan Ding <dingyihan(a)uniontech.com> bpf: allow UTF-8 literals in bpf_bprintf_prepare() Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix precedence bug in convert_bpf_ld_abs alignment check Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Take state lock for af_unix iter Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Fix af_unix null-ptr-deref in proto update Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Fix af_unix iter deadlock Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Fix off-by-one in check_imm signed range check Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path Shiji Yang <yangshiji66(a)outlook.com> mtd: spi-nor: swp: check SR_TB flag when getting tb_mask Jonas Gorski <jonas.gorski(a)gmail.com> mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: Allow post_sfdp hook to return errors Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Add support for Infineon S25FS256T Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Make RD_ANY_REG_OP macro take number of dummy bytes Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: spansion: Replace hardcoded values for addr_nbytes/addr_mode_nbytes Takahiro Kuwano <Takahiro.Kuwano(a)infineon.com> mtd: spi-nor: spansion: Rename s28hs512t prefix Haibo Chen <haibo.chen(a)nxp.com> mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() Cole Leavitt <cole(a)unwrap.rs> soundwire: bus: demote UNATTACHED state warnings to dev_dbg() Khairul Anuar Romli <karom.9560(a)gmail.com> dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Christoph Hellwig <hch(a)lst.de> arm64/xor: fix conflicting attributes for xor_block_template Aaro Koskinen <aaro.koskinen(a)iki.fi> ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX Alexander Koskovich <AKoskovich(a)pm.me> arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: llcc: fix v1 SB syndrome register offset Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() Michal Grzedzicki <mge(a)meta.com> unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure Sumit Gupta <sumitg(a)nvidia.com> soc/tegra: cbb: Set ERD on resume for err interrupt David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> arm64: dts: qcom: sm8450: Fix GIC_ITS range length Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: register reasons for probe deferrals Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soc: qcom: ocmem: use scoped device node handling to simplify error paths Akari Tsuyukusa <akkun11.open(a)gmail.com> arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count Akari Tsuyukusa <akkun11.open(a)gmail.com> arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count Sherry Sun <sherry.sun(a)nxp.com> arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Joshua Klinesmith <joshuaklinesmith(a)gmail.com> ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: prevent NULL pointer dereference during unmount Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: add some missing log locking Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Call unlock_new_inode before d_instantiate Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix missing return in invalidate_committed's error path Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: sc6000: Keep the programmed board state in card-private data Takashi Iwai <tiwai(a)suse.de> ALSA: sc6000: Use standard print API Pei Xiao <xiaopei01(a)kylinos.cn> spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Allow system suspend when the Endpoint link is not up Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable PERST# IRQ only in Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Don't force the device into the D0 state before L2 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Increase LTSSM poll time on surprise link down Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Fix polling delay for L2 state Frank Li <Frank.Li(a)nxp.com> PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: compress: return the configured codec from get_params Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Add support for compress API for stream data/offset Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Prepare set_stream_data_offset for compress API Daniel Baluta <daniel.baluta(a)nxp.com> ASoC: SOF: Prepare ipc_msg_data to be used with compress API V sujith kumar Reddy <Vsujithkumar.Reddy(a)amd.com> ASoC: SOF: amd: Fix for reading position updates from stream box. Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> ALSA: scarlett2: Add missing sentinel initializer field Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement AnishMulay <anishm7030(a)gmail.com> selftests/mm: skip migration tests if NUMA is unavailable Chen-Yu Tsai <wenst(a)chromium.org> PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: qdsp6: topology: check widget type before accessing data Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_micfil: Fix event generation in micfil_quality_set() Felix Gu <ustc.gu(a)gmail.com> pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/shrinker: Fix can_block() logic Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Yuanjie Yang <yuanjie.yang(a)oss.qualcomm.com> drm/msm/dpu: fix mismatch between power and frequency Pei Xiao <xiaopei01(a)kylinos.cn> spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: look at the right prop for gfx queue priority Daniel Jordan <daniel.m.jordan(a)oracle.com> padata: Put CPU offline callback in ONLINE section to allow failure Chuyi Zhou <zhouchuyi(a)bytedance.com> padata: Remove cpu online check from cpu add and removal Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Guillaume Gonnet <ggonnet.linux(a)gmail.com> dm init: ensure device probing has finished in dm-mod.waitfor= Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu: Add default case in DVI mode validation Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write hang in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: backend: fix error pointer dereference Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Jiayuan Chen <jiayuan.chen(a)linux.dev> net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master Xin Long <lucien.xin(a)gmail.com> sctp: fix missing encap_port propagation for GSO fragments Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Florian Westphal <fw(a)strlen.de> netfilter: xt_socket: enable defrag after all other checks Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix racing timeout handler Zak Kemble <zakkemble(a)gmail.com> net: bcmgenet: switch to use 64bit statistics Doug Berger <opendmb(a)gmail.com> net: bcmgenet: support reclaiming unsent Tx packets Doug Berger <opendmb(a)gmail.com> net: bcmgenet: move DESC_INDEX flow to ring 0 Doug Berger <opendmb(a)gmail.com> net: bcmgenet: add bcmgenet_has_* helpers Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Remove custom ndo_poll_controller() Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Remove TX ring full logging Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Wang Wensheng <wsw9603(a)163.com> arm64: kexec: Remove duplicate allocation for trans_pgd Haoyu Lu <hechushiguitu666(a)gmail.com> ACPI: AGDI: fix missing newline in error message Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Eric Dumazet <edumazet(a)google.com> macvlan: annotate data-races around port->bc_queue_len_used Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: fix incorrect register write to USB_UPHY_XTAL Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() David Carlier <devnexen(a)gmail.com> bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Thorsten Blum <thorsten.blum(a)toblux.com> bpf, devmap: Remove unnecessary if check in for loop Petr Pavlu <petr.pavlu(a)suse.com> module: Fix freeing of charp module parameters when CONFIG_SYSFS=n Petr Pavlu <petr.pavlu(a)suse.com> params: Replace __modinit with __init_or_module Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: globalize lookup_or_create_module_kobject() Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: param: rename locate_module_kobject Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: add independent dependencies for FSL_DPAA2_SWITCH Feng Yang <yangfeng(a)kylinos.cn> bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap Vadim Fedorenko <vadfed(a)meta.com> bpf: Add CHECKSUM_COMPLETE to bpf test progs Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Thomas Gleixner <tglx(a)kernel.org> hrtimer: Reduce trace noise in hrtimer_start() Peter Zijlstra <peterz(a)infradead.org> hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() Richard Clark <richard.xnu.clark(a)gmail.com> hrtimers: Update the return type of enqueue_hrtimer() Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gui-Dong Han <hanguidong02(a)gmail.com> debugfs: check for NULL pointer in debugfs_create_str() Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Ming Lei <ming.lei(a)redhat.com> blk-cgroup: wait for blkcg cleanup before initializing new disk Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Amit Kumar Mahapatra <amit.kumar-mahapatra(a)amd.com> mtd: spi-nor: sst: Fix SST write failure Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Bence Csókás <csokas.bence(a)prolan.hu> mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Paul E. McKenney <paulmck(a)kernel.org> exit: Sleep at TASK_IDLE when waiting for application core dump Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Remove remaining dependencies of hci_request Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Dong Chenchen <dongchenchen2(a)huawei.com> net: Fix icmp host relookup triggering ip_rt_bug Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Chao Yu <chao(a)kernel.org> f2fs: fix to detect potential corrupted nid in free_nid_list Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> regset: use kvzalloc() for regset_get_alloc() Youngmin Nam <youngmin.nam(a)samsung.com> arm64: set __exception_irq_entry with __irq_entry as a default Ming Lei <ming.lei(a)redhat.com> blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none Jianpeng Chang <jianpeng.chang.cn(a)windriver.com> net: enetc: fix the deadlock of enetc_mdio_lock Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Mark Rutland <mark.rutland(a)arm.com> arm64: mm: fix VA-range sanity check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: read txq->read_ptr under lock Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Takashi Iwai <tiwai(a)suse.de> ALSA: control: Avoid WARN() for symlink errors André Draszik <andre.draszik(a)linaro.org> scsi: ufs: core: Fix use-after free in init error and remove paths David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Dawei Li <set_pte_at(a)outlook.com> soc: qcom: apr: make remove callback of apr driver void returned Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Ming Lei <ming.lei(a)redhat.com> ublk: fix deadlock when reading partition table David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: clean up FDB, MDB, VLAN entries on unbind Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Andrew Price <anprice(a)redhat.com> gfs2: Improve gfs2_consist_inode() usage Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Sasha Levin <sashal(a)kernel.org> Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()" Sasha Levin <sashal(a)kernel.org> Revert "net: ethernet: xscale: Check for PTP support properly" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Christian König <christian.koenig(a)amd.com> drm/amdgpu: remove two invalid BUG_ON()s Wang Liang <wangliang74(a)huawei.com> bonding: check xdp prog when set bond mode Hangbin Liu <liuhangbin(a)gmail.com> bonding: return detailed error when loading native XDP fails Eric Dumazet <edumazet(a)google.com> net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() Eric Dumazet <edumazet(a)google.com> net: add proper RCU protection to /proc/net/ptype Jeongjun Park <aha310510(a)gmail.com> ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Sasha Levin <sashal(a)kernel.org> Revert "dmaengine: idxd: Fix not releasing workqueue on .release()" Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Paolo Abeni <pabeni(a)redhat.com> epoll: use refcount to reduce ep_mutex contention Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Documentation/mm/hugetlbfs_reserv.rst | 2 +- Documentation/networking/bonding.rst | 15 + Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-omap1/clock_data.c | 4 +- arch/arm/mach-versatile/integrator_cp.c | 13 +- arch/arm/net/bpf_jit_32.c | 6 + .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- .../arm64/boot/dts/freescale/imx8mm-tqma8mqml.dtsi | 2 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 2 +- .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 2 +- .../boot/dts/freescale/imx8mp-icore-mx8mp.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt6795.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 1 + arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 + arch/arm64/boot/dts/qcom/sm8450.dtsi | 5 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/exception.h | 5 - arch/arm64/include/asm/xor.h | 2 +- arch/arm64/kernel/machine_kexec.c | 3 - arch/arm64/kvm/vgic/vgic-its.c | 4 + arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/mm/mmu.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/mm/init.c | 4 - arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kernel/time.c | 6 +- arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/s390/kernel/debug.c | 8 + arch/s390/kvm/interrupt.c | 3 +- arch/s390/kvm/pci.c | 6 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kvm/mmu/mmu.c | 36 +- arch/x86/kvm/mmu/spte.h | 5 + arch/x86/kvm/svm/nested.c | 38 +- arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 13 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/trace.h | 2 +- arch/x86/kvm/x86.c | 14 +- block/blk-cgroup.c | 15 + block/blk-mq.c | 10 +- certs/extract-cert.c | 6 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/arm64/agdi.c | 2 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 39 +- drivers/base/dd.c | 20 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/block/rbd.c | 6 +- drivers/block/ublk_drv.c | 28 +- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/hci_ldisc.c | 51 +- drivers/bluetooth/virtio_bt.c | 39 +- drivers/bus/imx-weim.c | 2 +- drivers/cdrom/cdrom.c | 73 +- drivers/char/ipmi/ipmi_si_intf.c | 70 +- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/clk/qcom/dispcc-sm8450.c | 2 +- drivers/clk/qcom/gcc-sc8180x.c | 64 +- drivers/clk/visconti/pll.c | 2 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 - drivers/dma/idxd/sysfs.c | 1 - drivers/dma/mxs-dma.c | 1 + drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/arm_ffa/bus.c | 4 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/firmware/imx/scu-pd.c | 1 + drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 16 +- drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c | 3 +- drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 7 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++ drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 9 + .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 118 +++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h | 1 + drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 1 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- drivers/gpu/drm/bridge/chipone-icn6211.c | 4 +- drivers/gpu/drm/bridge/ite-it66121.c | 5 + .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/gma500/oaktrail_lvds.c | 9 +- drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_psr.c | 18 +- drivers/gpu/drm/i915/display/skl_watermark.c | 43 +- drivers/gpu/drm/i915/display/skl_watermark.h | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 3 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 - drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + drivers/gpu/drm/msm/msm_gem_shrinker.c | 5 +- drivers/gpu/drm/msm/msm_iommu.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 6 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/hid-uclogic-core.c | 4 +- drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 30 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- drivers/iommu/intel/iommu.c | 3 + drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/leds/blink/leds-lgm-sso.c | 2 - drivers/mailbox/mailbox-test.c | 39 +- drivers/mailbox/mailbox.c | 3 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 143 +++- drivers/md/dm-init.c | 4 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 +- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/saa7164/saa7164-core.c | 47 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 9 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/mtd/parsers/ofpart_core.c | 4 +- drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/core.h | 10 +- drivers/mtd/spi-nor/micron-st.c | 4 +- drivers/mtd/spi-nor/sfdp.c | 47 +- drivers/mtd/spi-nor/spansion.c | 106 ++- drivers/mtd/spi-nor/sst.c | 50 +- drivers/mtd/spi-nor/swp.c | 4 +- drivers/net/bareudp.c | 24 +- drivers/net/bonding/bond_3ad.c | 123 ++-- drivers/net/bonding/bond_main.c | 90 ++- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 74 +++ drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/dsa/mt7530.c | 85 +-- drivers/net/dsa/mt7530.h | 70 +- drivers/net/dsa/realtek/rtl8365mb.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 733 +++++++++------------ drivers/net/ethernet/broadcom/genet/bcmgenet.h | 68 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/freescale/Makefile | 3 +- drivers/net/ethernet/freescale/dpaa2/Kconfig | 4 + drivers/net/ethernet/freescale/enetc/enetc.c | 25 +- drivers/net/ethernet/ibm/ibmveth.c | 22 + drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 +- drivers/net/ethernet/intel/iavf/iavf.h | 9 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 52 +- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 76 +-- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 2 - drivers/net/ethernet/intel/ice/ice_vf_lib.c | 26 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 +- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 8 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 35 +- .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 2 + drivers/net/ethernet/xscale/ixp4xx_eth.c | 60 +- drivers/net/ethernet/xscale/ptp_ixp46x.c | 3 - drivers/net/hamradio/6pack.c | 39 +- drivers/net/ifb.c | 11 +- drivers/net/macvlan.c | 8 +- drivers/net/mctp/mctp-i2c.c | 4 +- drivers/net/netconsole.c | 26 +- drivers/net/netdevsim/dev.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/phy/mdio_bus.c | 4 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireless/ath/ath11k/ahb.c | 44 +- drivers/net/wireless/ath/ath11k/ce.h | 16 + drivers/net/wireless/ath/ath11k/core.c | 91 +++ drivers/net/wireless/ath/ath11k/core.h | 12 + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +- drivers/net/wireless/ath/ath11k/hal.c | 31 +- drivers/net/wireless/ath/ath11k/hal.h | 5 + drivers/net/wireless/ath/ath11k/hal_rx.c | 13 +- drivers/net/wireless/ath/ath11k/hal_rx.h | 18 +- drivers/net/wireless/ath/ath11k/hw.c | 398 ++++++++++- drivers/net/wireless/ath/ath11k/hw.h | 14 +- drivers/net/wireless/ath/ath11k/mac.c | 7 + drivers/net/wireless/ath/ath11k/pci.c | 2 + drivers/net/wireless/ath/ath11k/wmi.c | 19 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 15 + .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/intel/iwlwifi/queue/tx.c | 3 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/net/wireless/realtek/rtw89/phy.c | 2 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 + drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 3 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 51 +- drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 151 ++--- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/controller/pcie-mediatek-gen3.c | 8 +- drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 19 +- drivers/pci/pci.c | 48 +- drivers/pci/pci.h | 6 + drivers/pci/pcie/aer.c | 2 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 27 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/pinctrl/qcom/pinctrl-sm8150.c | 8 +- drivers/platform/surface/surfacepro3_button.c | 1 + drivers/platform/x86/adv_swbutton.c | 6 +- .../x86/dell/dell-wmi-sysman/enum-attributes.c | 34 +- drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/platform/x86/hp/hp_accel.c | 3 + drivers/platform/x86/intel/hid.c | 6 +- drivers/platform/x86/intel/vbtn.c | 6 +- drivers/platform/x86/panasonic-laptop.c | 5 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/pwm/pwm-imx-tpm.c | 8 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/rtc/rtc-ntxec.c | 2 +- drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/sd.c | 1 + drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 11 +- drivers/scsi/sr.h | 1 - drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/llcc-qcom.c | 2 +- drivers/soc/qcom/ocmem.c | 22 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/tegra/cbb/tegra234-cbb.c | 4 + drivers/soc/ti/omap_prm.c | 1 + drivers/soundwire/bus.c | 8 +- drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-hisi-kunpeng.c | 12 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mtk-snfi.c | 16 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 66 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 2 +- drivers/ufs/core/ufshcd.c | 31 +- drivers/ufs/host/ufshcd-pci.c | 2 - drivers/ufs/host/ufshcd-pltfrm.c | 25 +- drivers/usb/class/cdc-acm.c | 53 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/binfmt_elf.c | 2 +- fs/btrfs/inode.c | 2 +- fs/btrfs/space-info.c | 2 +- fs/ceph/xattr.c | 1 + fs/dcache.c | 4 +- fs/debugfs/file.c | 5 +- fs/erofs/dir.c | 28 +- fs/eventpoll.c | 201 ++++-- fs/ext2/inode.c | 14 +- fs/ext4/extents.c | 15 + fs/ext4/xattr.c | 4 +- fs/f2fs/compress.c | 90 +-- fs/f2fs/data.c | 28 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 17 +- fs/f2fs/super.c | 8 +- fs/f2fs/sysfs.c | 52 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 37 +- fs/gfs2/glops.c | 40 +- fs/gfs2/inode.c | 3 +- fs/gfs2/log.c | 33 +- fs/gfs2/xattr.c | 28 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/fslog.c | 12 +- fs/ntfs3/run.c | 18 +- fs/ntfs3/super.c | 7 +- fs/ocfs2/aops.c | 75 ++- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/inode.c | 31 + fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 4 +- fs/omfs/inode.c | 6 + fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifs_spnego.c | 16 + fs/smb/client/cifsacl.c | 1 + fs/smb/client/cifsfs.c | 2 + fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 27 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 17 + fs/smb/client/smb2pdu.h | 2 +- fs/smb/server/auth.c | 11 +- fs/smb/server/mgmt/user_session.c | 12 +- fs/smb/server/smb2pdu.c | 7 + fs/smb/server/smbacl.c | 19 +- fs/smb/server/transport_tcp.c | 4 +- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 5 + include/linux/cdrom.h | 1 + include/linux/container_of.h | 23 +- include/linux/cpuhotplug.h | 1 - include/linux/dev_printk.h | 10 + include/linux/device.h | 48 +- include/linux/dmi.h | 5 + include/linux/f2fs_fs.h | 1 + include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 45 +- include/linux/kvm_host.h | 3 +- include/linux/module.h | 2 + include/linux/moduleparam.h | 11 +- include/linux/netfilter/x_tables.h | 3 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/linux/padata.h | 12 +- include/linux/ppp_defs.h | 16 + include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/soc/qcom/apr.h | 2 +- include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/tcp.h | 10 +- include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/bluetooth/hci_sync.h | 17 + include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 4 + include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/netfilter/nf_queue.h | 1 + include/net/netfilter/nf_tables.h | 2 + include/net/pie.h | 2 +- include/net/pkt_cls.h | 2 + include/net/route.h | 6 - include/net/tcp.h | 2 +- include/net/udp_tunnel.h | 15 + include/trace/events/btrfs.h | 9 +- include/trace/events/rxrpc.h | 4 + include/trace/events/timer.h | 11 +- include/uapi/linux/bpf.h | 2 + include/uapi/linux/if_link.h | 3 + include/uapi/linux/kvm.h | 11 +- include/ufs/ufshcd.h | 1 - include/video/udlfb.h | 1 + init/main.c | 1 - io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 2 + io_uring/poll.c | 14 +- io_uring/timeout.c | 4 + kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/devmap.c | 8 +- kernel/bpf/helpers.c | 17 +- kernel/bpf/local_storage.c | 2 +- kernel/cgroup/rdma.c | 2 +- kernel/exit.c | 3 +- kernel/fork.c | 13 +- kernel/futex/requeue.c | 13 +- kernel/irq_work.c | 7 + kernel/locking/rtmutex.c | 13 +- kernel/module/main.c | 4 +- kernel/padata.c | 266 +++----- kernel/params.c | 46 +- kernel/regset.c | 6 +- kernel/taskstats.c | 1 + kernel/time/hrtimer.c | 56 +- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 ++- net/batman-adv/bridge_loop_avoidance.c | 65 +- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 +- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/af_bluetooth.c | 10 + net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_event.c | 21 +- net/bluetooth/hci_request.h | 21 - net/bluetooth/hci_sync.c | 14 +- net/bluetooth/iso.c | 14 +- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 60 +- net/bluetooth/mgmt.c | 6 + net/bluetooth/rfcomm/sock.c | 9 +- net/bluetooth/sco.c | 9 +- net/bpf/test_run.c | 63 +- net/bridge/br_multicast.c | 27 +- net/bridge/netfilter/Kconfig | 13 + net/bridge/netfilter/Makefile | 2 +- net/bridge/netfilter/ebtable_broute.c | 14 +- net/bridge/netfilter/ebtable_filter.c | 14 +- net/bridge/netfilter/ebtable_nat.c | 12 +- net/bridge/netfilter/ebtables.c | 71 +- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/auth.c | 4 +- net/ceph/crush/crush.c | 6 +- net/ceph/mon_client.c | 2 + net/ceph/osdmap.c | 14 +- net/core/filter.c | 4 +- net/core/flow_dissector.c | 13 +- net/core/neighbour.c | 34 +- net/core/net-procfs.c | 49 +- net/core/rtnetlink.c | 1 + net/dsa/dsa2.c | 38 +- net/ethtool/bitset.c | 8 +- net/ipv4/icmp.c | 15 +- net/ipv4/inet_connection_sock.c | 5 +- net/ipv4/netfilter/Kconfig | 59 +- net/ipv4/netfilter/Makefile | 2 +- net/ipv4/netfilter/arp_tables.c | 36 +- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/netfilter/arptable_filter.c | 27 +- net/ipv4/netfilter/ip_tables.c | 18 +- net/ipv4/netfilter/iptable_filter.c | 27 +- net/ipv4/netfilter/iptable_mangle.c | 29 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 26 +- net/ipv4/netfilter/iptable_security.c | 27 +- net/ipv4/nexthop.c | 4 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 -- net/ipv4/tcp.c | 17 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_minisocks.c | 5 +- net/ipv4/tcp_output.c | 20 +- net/ipv4/tcp_recovery.c | 2 +- net/ipv4/udp_tunnel_core.c | 48 ++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 -- net/ipv6/ip6_udp_tunnel.c | 69 ++ net/ipv6/netfilter/Kconfig | 30 +- net/ipv6/netfilter/Makefile | 2 +- net/ipv6/netfilter/ip6_tables.c | 18 +- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/netfilter/ip6table_filter.c | 26 +- net/ipv6/netfilter/ip6table_mangle.c | 27 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 24 +- net/ipv6/netfilter/ip6table_security.c | 27 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 4 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/Kconfig | 22 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 160 +++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nf_queue.c | 4 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_dynset.c | 10 +- net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/x_tables.c | 116 +++- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/netfilter/xt_socket.c | 23 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport-netdev.c | 6 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 9 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 8 +- net/sched/em_cmp.c | 5 +- net/sched/em_nbyte.c | 2 + net/sched/em_text.c | 11 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 26 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 44 +- net/sched/sch_pie.c | 52 +- net/sched/sch_red.c | 33 +- net/sched/sch_sfb.c | 54 +- net/sched/sch_taprio.c | 176 ++--- net/sctp/inqueue.c | 1 + net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/af_smc.c | 3 +- net/smc/smc_clc.c | 4 +- net/smc/smc_tracepoint.h | 2 +- net/strparser/strparser.c | 8 + net/tipc/msg.c | 14 +- net/tls/tls.h | 1 + net/tls/tls_strp.c | 6 + net/tls/tls_sw.c | 30 +- net/unix/af_unix.c | 9 +- net/unix/diag.c | 21 +- net/unix/unix_bpf.c | 3 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 23 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 2 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 17 +- security/integrity/ima/ima_crypto.c | 2 +- security/keys/keyring.c | 1 + sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 7 - sound/core/control.c | 4 + sound/core/control_led.c | 14 +- sound/core/misc.c | 44 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/isa/sc6000.c | 285 ++++---- sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_conexant.c | 34 +- sound/pci/hda/patch_realtek.c | 8 +- sound/soc/amd/yc/acp6x-mach.c | 35 + sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++- sound/soc/fsl/fsl_micfil.c | 28 +- sound/soc/fsl/fsl_xcvr.c | 22 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 17 +- sound/soc/qcom/qdsp6/q6core.c | 4 +- sound/soc/qcom/qdsp6/topology.c | 8 +- sound/soc/soc-core.c | 1 + sound/soc/sof/amd/acp-common.c | 1 + sound/soc/sof/amd/acp-ipc.c | 34 +- sound/soc/sof/amd/acp.h | 7 +- sound/soc/sof/compress.c | 11 +- sound/soc/sof/intel/hda-ipc.c | 8 +- sound/soc/sof/intel/hda.h | 4 +- sound/soc/sof/ipc3-pcm.c | 3 +- sound/soc/sof/ipc3.c | 4 +- sound/soc/sof/mediatek/mt8186/mt8186.c | 2 +- sound/soc/sof/mediatek/mt8195/mt8195.c | 2 +- sound/soc/sof/ops.h | 8 +- sound/soc/sof/pcm.c | 2 + sound/soc/sof/sof-priv.h | 13 +- sound/soc/sof/stream-ipc.c | 57 +- sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +- sound/usb/caiaq/device.c | 39 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 88 ++- sound/usb/midi.c | 21 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/mixer_scarlett2.c | 2 +- sound/usb/quirks.c | 4 +- sound/usb/stream.c | 62 +- sound/usb/stream.h | 3 +- tools/accounting/getdelays.c | 41 +- tools/accounting/procacct.c | 40 +- tools/include/uapi/linux/bpf.h | 2 + tools/lib/bpf/relo_core.c | 2 + tools/perf/util/branch.h | 3 + tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 51 +- tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 37 +- tools/testing/selftests/bpf/prog_tests/snprintf.c | 3 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- .../testing/selftests/mqueue/{setting => settings} | 0 .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + tools/testing/selftests/vm/migration.c | 3 +- virt/kvm/dirty_ring.c | 3 +- 867 files changed, 9112 insertions(+), 4400 deletions(-)

4 months

[PATCH 5.15 000/776] 5.15.209-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.209 release. There are 776 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.209-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.209-rc1 Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: validate rx_req_idx to prevent out-of-bounds array access Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Ido Schimmel <idosch(a)nvidia.com> bridge: mcast: Fix a possible use-after-free when removing a bridge port Petr Machata <petrm(a)nvidia.com> net: bridge: Flush multicast groups when snooping is disabled Guangshuo Li <lgs201920130244(a)gmail.com> RDMA/rtrs: Fix use-after-free in path file creation cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: hp_accel: Check ACPI_COMPANION() against NULL Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: preserve VLAN tags on trapped link-local frames Arınç ÜNAL <arinc.unal(a)arinc9.com> net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: fix FDB entries not aging out with short timeout Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: sync driver-specific behavior of MT7531 variants Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/snapshot: fix dumping of the unaligned regions Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Mikko Perttunen <mperttunen(a)nvidia.com> drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Nicolas Escande <nico.escande(a)gmail.com> wifi: ath11k: fix error path leaks in some WMI WOW calls Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Kuniyuki Iwashima <kuniyu(a)google.com> tcp: Fix imbalanced icsk_accept_queue count. Florian Westphal <fw(a)strlen.de> netfilter: bridge: eb_tables: close module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: close dangling table module init race Florian Westphal <fw(a)strlen.de> netfilter: ebtables: move to two-stage removal scheme Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xtables_unregister_table_exit Florian Westphal <fw(a)strlen.de> netfilter: x_tables: add and use xt_unregister_table_pre_exit Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: Exclude LEGACY TABLES on PREEMPT_RT. Breno Leitao <leitao(a)debian.org> netfilter: Make legacy configs user selectable Kuniyuki Iwashima <kuniyu(a)amazon.com> netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c Florian Westphal <fw(a)strlen.de> netfilter: xtables: fix up kconfig dependencies Florian Westphal <fw(a)strlen.de> netfilter: ebtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: xtables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arptables: allow xtables-nft only builds Florian Westphal <fw(a)strlen.de> netfilter: arp_tables: allow use of arpt_do_table as hookfn Florian Westphal <fw(a)strlen.de> netfilter: x_tables: unregister the templates first Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla <sudeep.holla(a)kernel.org> firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Julien Chauveau <chauveau.julien(a)gmail.com> drm/bridge: it66121: acquire reset GPIO in probe Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: set fwnode->secondary to NULL in fwnode_init() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: hold bridge skb->dev while queued Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name Abdun Nihaal <nihaal(a)cse.iitm.ac.in> net: wwan: iosm: fix potential memory leaks in ipc_imem_init() Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Sasha Levin <sashal(a)kernel.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Sean Christopherson <seanjc(a)google.com> KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Pavel Begunkov <asml.silence(a)gmail.com> io_uring: prevent opcode speculation Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915: skip __i915_request_skip() for already signaled requests Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Qiang Ma <maqianga(a)uniontech.com> KVM: x86: Fix Xen hypercall tracepoint argument assignment Aaron Sacks <contact(a)xchglabs.com> KVM: Reject wrapped offset in kvm_reset_dirty_gfn() Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Matt Vollrath <tactii(a)gmail.com> i40e: Cleanup PTP pins on probe failure Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Qingqing Yang <qingqing.yang(a)broadcom.com> flow_dissector: Do not count vlan tags inside tunnel payload Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Do not dereference non-socket transports in sysfs Anna Schumaker <Anna.Schumaker(a)Netapp.com> SUNRPC: Check if the xprt is connected before handling sysfs reads Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Fix missing error check for jack detection wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 Oldherl Oh <me(a)oldherl.one> ALSA: hda/conexant: fix some typos bo liu <bo.liu(a)senarytech.com> ALSA: hda/conexant: add a new hda codec SN6140 Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: choke: remove unused variables in struct choke_sched_data Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> net: sched: sch_netem: Refactor code in 4-state loss generator Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() Enze Li <lienze(a)kylinos.cn> scsi: sr: Add memory allocation failure handling for get_capabilities() Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd3.1: Don't validate the firmware when already validated Alexandre Demers <alexandre.f.demers(a)gmail.com> drm/amdgpu: fix spelling typos Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: gred/red: remove unused variables in struct red_stats Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: scope conn->binding slowpath to bound sessions only DaeMyung Kang <charsyam(a)gmail.com> ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Wojciech Drewek <wojciech.drewek(a)intel.com> flow_dissector: Add PPPoE dissectors Boris Sukholitko <boris.sukholitko(a)broadcom.com> flow_dissector: Add number of vlan tags dissector Boris Sukholitko <boris.sukholitko(a)broadcom.com> dissector: do not set invalid PPP protocol Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: replace safety precautions with comments Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: stop going through private ops for dequeue and peek Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for PCIe power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Use retention for USB power domains Val Packett <val(a)packett.cool> clk: qcom: gcc-sc8180x: Add missing GDSCs Val Packett <val(a)packett.cool> dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Pengpeng Hou <pengpeng(a)iscas.ac.cn> platform/x86: dell-wmi-sysman: bound enumeration string aggregation Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Pengpeng Hou <pengpeng(a)iscas.ac.cn> fs/ntfs3: terminate the cached volume label after UTF-8 conversion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices наб <nabijaczleweli(a)nabijaczleweli.xyz> tty: hvc: remove HVC_IUCV_MAGIC Chen Ni <nichen(a)iscas.ac.cn> leds: lgm-sso: Remove duplicate assignments for priv->mmap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Billy Tsai <billy_tsai(a)aspeedtech.com> i3c: mipi-i3c-hci: fix IBI payload length calculation for final status Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Mike Leach <mike.leach(a)arm.com> perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path Shiji Yang <yangshiji66(a)outlook.com> mtd: spi-nor: swp: check SR_TB flag when getting tb_mask Haibo Chen <haibo.chen(a)nxp.com> mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() Khairul Anuar Romli <karom.9560(a)gmail.com> dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() Michal Grzedzicki <mge(a)meta.com> unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: register reasons for probe deferrals Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soc: qcom: ocmem: use scoped device node handling to simplify error paths Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Joshua Klinesmith <joshuaklinesmith(a)gmail.com> ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: prevent NULL pointer dereference during unmount Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: add some missing log locking Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: sc6000: Keep the programmed board state in card-private data Takashi Iwai <tiwai(a)suse.de> ALSA: sc6000: Use standard print API Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down Manikanta Maddireddy <mmaddireddy(a)nvidia.com> PCI: tegra194: Increase LTSSM poll time on surprise link down Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Fix polling delay for L2 state Frank Li <Frank.Li(a)nxp.com> PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() Felix Gu <ustc.gu(a)gmail.com> pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Pei Xiao <xiaopei01(a)kylinos.cn> spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Guillaume Gonnet <ggonnet.linux(a)gmail.com> dm init: ensure device probing has finished in dm-mod.waitfor= Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Jiayuan Chen <jiayuan.chen(a)linux.dev> net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master Xin Long <lucien.xin(a)gmail.com> sctp: fix missing encap_port propagation for GSO fragments Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: phy: qcom: at803x: Use the correct bit to disable extended next page Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Florian Westphal <fw(a)strlen.de> netfilter: xt_socket: enable defrag after all other checks Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Frederick Lawler <fred(a)cloudflare.com> bpf-lsm: Make bpf_lsm_userns_create() sleepable Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Eric Dumazet <edumazet(a)google.com> macvlan: annotate data-races around port->bc_queue_len_used Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Chih Kai Hsu <hsu.chih.kai(a)realtek.com> r8152: fix incorrect register write to USB_UPHY_XTAL David Carlier <devnexen(a)gmail.com> bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Thorsten Blum <thorsten.blum(a)toblux.com> bpf, devmap: Remove unnecessary if check in for loop Petr Pavlu <petr.pavlu(a)suse.com> module: Fix freeing of charp module parameters when CONFIG_SYSFS=n Petr Pavlu <petr.pavlu(a)suse.com> params: Replace __modinit with __init_or_module Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: globalize lookup_or_create_module_kobject() Shyam Saini <shyamsaini(a)linux.microsoft.com> kernel: param: rename locate_module_kobject Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n Cai Xinchen <caixinchen1(a)huawei.com> dpaa2: add independent dependencies for FSL_DPAA2_SWITCH Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gui-Dong Han <hanguidong02(a)gmail.com> debugfs: check for NULL pointer in debugfs_create_str() Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Dipendra Khadka <kdipendra88(a)gmail.com> octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Florian Fainelli <florian.fainelli(a)broadcom.com> um: virt-pci: Fix build failure Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: do not expire session on binding failure Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix backport of io_poll_add() changes Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe André Draszik <andre.draszik(a)linaro.org> scsi: ufs: core: Fix use-after free in init error and remove paths Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Jeongjun Park <aha310510(a)gmail.com> ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix flow control handling in tx path Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Vasant Karasulli <vsntk18(a)gmail.com> iommu: fix a reference count leak in iommu_sva_bind_device() David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: unset conn->binding on failed binding request Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" David Gow <davidgow(a)google.com> drivers: base: Free devm resources when unregistering a device Miquel Sabaté Solà <mikisabate(a)gmail.com> cpufreq: Avoid a bad reference count on CPU node Jakub Kicinski <kuba(a)kernel.org> net: clear the dst when changing skb protocol Thomas Weißschuh <linux(a)weissschuh.net> fbdev: efifb: Register sysfs groups through driver core Yu Kuai <yukuai3(a)huawei.com> md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang <liaochang1(a)huawei.com> cpufreq: governor: Free dbs_data directly when gov->init() fails David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Add more attributes checks in mi_enum_attr() Filipe Manana <fdmanana(a)suse.com> btrfs: lock the inode in shared mode before starting fiemap Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation NeilBrown <neilb(a)suse.de> SUNRPC: lock against ->sock changing during sysfs read Chao Yu <chao(a)kernel.org> f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode Lin Ma <linma(a)zju.edu.cn> vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: af_bluetooth: Fix deadlock Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch when turning buffer off Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: Add netif_device_attach/detach into PF reset flow Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Kill timer properly at removal Kees Cook <keescook(a)chromium.org> pstore: inode: Only d_invalidate() is needed Chao Yu <chao(a)kernel.org> f2fs: fix to wait on block writeback for post_read case Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix TSO DMA API usage causing oops Daniel Wagner <dwagner(a)suse.de> nvmet: always initialize cqe.result Lang Yu <Lang.Yu(a)amd.com> drm/amdgpu: unmap and remove csa_va properly Zilin Guan <zilin(a)seu.edu.cn> binfmt_misc: restore write access before closing files opened by open_exec() Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: No more self recovery Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO Alexander Aring <aahringo(a)redhat.com> dlm: fix possible lkb_resource null dereference Kuniyuki Iwashima <kuniyu(a)google.com> Bluetooth: hci_core: Fix use-after-free in vhci_flush() Joonwon Kang <joonwonkang(a)google.com> mailbox: Prevent out-of-bounds access in of_mbox_index_xlate() Qu Wenruo <wqu(a)suse.com> btrfs: do not strictly require dirty metadata threshold for metadata writepages Qu Wenruo <wqu(a)suse.com> btrfs: send: check for inline extents in range_is_hole_in_parent() Oleg Nesterov <oleg(a)redhat.com> x86/uprobes: Fix XOL allocation failure for 32-bit tasks Khairul Anuar Romli <khairul.anuar.romli(a)altera.com> spi: cadence-quadspi: Implement refcount to handle unbind during busy Alexander Aring <aahringo(a)redhat.com> fs: dlm: fix use after free in midcomms commit Guodong Xu <guodong(a)riscstar.com> dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Eric Dumazet <edumazet(a)google.com> net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet <edumazet(a)google.com> net: add skb_header_pointer_careful() helper Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: disable recursive forward error correction Keith Busch <kbusch(a)kernel.org> blk-mq: use quiesced elevator switch when reinitializing queues Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: read txq->read_ptr under lock Ye Bin <yebin10(a)huawei.com> f2fs: fix null-ptr-deref in f2fs_submit_page_bio() Heiko Carstens <hca(a)linux.ibm.com> s390/xor: Fix xor_xc_2() inline assembly constraints Takashi Iwai <tiwai(a)suse.de> ALSA: control: Avoid WARN() for symlink errors Jaskaran Singh <jsingh(a)cloudlinux.com> nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Jaskaran Singh <jsingh(a)cloudlinux.com> Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Wang Yufen <wangyufen(a)huawei.com> netdevsim: Fix memory leak of nsim_dev->fa_cookie Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix deadlock and link starvation in outgoing data path Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write hongnanli <hongnan.li(a)linux.alibaba.com> fs/ocfs2: fix comments mentioning i_mutex Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Håkon Bugge <haakon.bugge(a)oracle.com> PCI/ACPI: Restrict program_hpx_type2() to AER bits Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Andrew Price <anprice(a)redhat.com> gfs2: Improve gfs2_consist_inode() usage Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Sasha Levin <sashal(a)kernel.org> Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()" Sasha Levin <sashal(a)kernel.org> Revert "net: ethernet: xscale: Check for PTP support properly" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Cezar Bulinaru <cbulinaru(a)gmail.com> net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Paulo Alcantara <pc(a)manguebit.com> smb: client: fix potential UAF in smb2_is_valid_oplock_break() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> fsl-mc: Use driver_set_override() instead of open-coding Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Update for native DSD support quirks Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Jamie Iles <quic_jiles(a)quicinc.com> i3c: fix uninitialized variable use in i2c setup Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Paolo Abeni <pabeni(a)redhat.com> epoll: use refcount to reduce ep_mutex contention Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning ------------- Diffstat: Documentation/vm/hugetlbfs_reserv.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-integrator/integrator_cp.c | 13 +- .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 1 + arch/arm64/crypto/aes-modes.S | 4 +- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 299 ++++++++++++--- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 20 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/s390/kernel/debug.c | 8 + arch/s390/lib/xor.c | 4 +- arch/um/drivers/cow_user.c | 8 +- arch/um/drivers/virt-pci.c | 2 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/svm/nested.c | 24 +- arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 13 + arch/x86/kvm/trace.h | 2 +- arch/x86/kvm/x86.c | 18 +- block/blk-mq.c | 6 +- block/blk.h | 3 +- block/elevator.c | 4 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 39 +- drivers/base/dd.c | 20 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/bluetooth/hci_ldisc.c | 51 ++- drivers/bluetooth/virtio_bt.c | 39 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 25 +- drivers/cdrom/cdrom.c | 73 ++-- drivers/char/ipmi/ipmi_si_intf.c | 70 +++- drivers/char/ipmi/ipmi_ssif.c | 74 +++- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/clk/qcom/gcc-sc8180x.c | 64 +++- drivers/cpufreq/cpufreq_governor.c | 10 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 - drivers/dma/mmp_pdma.c | 6 + drivers/dma/mxs-dma.c | 1 + drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/arm_ffa/bus.c | 4 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/firmware/imx/scu-pd.c | 1 + drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 16 +- drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c | 3 +- drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 + drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++++ .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 118 +++++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.h | 1 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- drivers/gpu/drm/bridge/ite-it66121.c | 5 + .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/gt/intel_reset.c | 3 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/msm/msm_iommu.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i3c/master.c | 7 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 30 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 + drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- drivers/iommu/intel/iommu.c | 3 + drivers/iommu/iommu.c | 6 +- drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/leds/blink/leds-lgm-sso.c | 2 - drivers/mailbox/mailbox-test.c | 39 +- drivers/mailbox/mailbox.c | 9 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 111 ++++-- drivers/md/dm-init.c | 4 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 12 +- drivers/md/dm-verity-fec.h | 3 - drivers/md/md-bitmap.c | 4 + drivers/md/md.c | 4 + drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +-- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/mtd/parsers/ofpart_core.c | 4 +- drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/spi-nor/swp.c | 4 +- drivers/net/bareudp.c | 24 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/can/usb/gs_usb.c | 17 +- drivers/net/dsa/mt7530.c | 85 ++--- drivers/net/dsa/mt7530.h | 70 ++-- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 15 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/freescale/Makefile | 3 +- drivers/net/ethernet/freescale/dpaa2/Kconfig | 4 + drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 +- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ice/ice_main.c | 8 + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 6 + drivers/net/ethernet/microsoft/mana/hw_channel.c | 35 +- .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +- drivers/net/ethernet/xscale/ixp4xx_eth.c | 60 +-- drivers/net/ethernet/xscale/ptp_ixp46x.c | 3 - drivers/net/hamradio/6pack.c | 39 +- drivers/net/macvlan.c | 8 +- drivers/net/netdevsim/dev.c | 3 +- drivers/net/phy/at803x.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/phy/mdio_bus.c | 4 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 ++- drivers/net/tap.c | 23 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/lan78xx.c | 31 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireless/ath/ath11k/hal.c | 14 +- drivers/net/wireless/ath/ath11k/wmi.c | 19 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 15 + .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/intel/iwlwifi/queue/tx.c | 3 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 + drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/core.c | 3 +- drivers/nvme/target/fabrics-cmd.c | 6 - drivers/of/property.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 74 ++-- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +-- drivers/pci/endpoint/functions/pci-epf-vntb.c | 18 +- drivers/pci/pci-acpi.c | 59 ++- drivers/pci/pci.c | 48 ++- drivers/pci/pci.h | 9 + drivers/pci/pcie/aer.c | 5 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/platform/surface/surfacepro3_button.c | 1 + drivers/platform/x86/adv_swbutton.c | 6 +- .../x86/dell/dell-wmi-sysman/enum-attributes.c | 34 +- drivers/platform/x86/dell/dell_rbu.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/platform/x86/hp/hp_accel.c | 3 + drivers/platform/x86/intel/hid.c | 6 +- drivers/platform/x86/intel/vbtn.c | 6 +- drivers/platform/x86/panasonic-laptop.c | 5 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/rtc/rtc-ntxec.c | 2 +- drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 25 +- drivers/scsi/sr.h | 1 - drivers/scsi/ufs/ufshcd-pci.c | 2 - drivers/scsi/ufs/ufshcd-pltfrm.c | 25 +- drivers/scsi/ufs/ufshcd.c | 31 +- drivers/scsi/ufs/ufshcd.h | 1 - drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/ocmem.c | 22 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/ti/omap_prm.c | 1 + drivers/spi/spi-cadence-quadspi.c | 34 ++ drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-hisi-kunpeng.c | 12 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 11 +- drivers/tty/n_gsm.c | 407 ++++++++++++++------- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vdpa/vdpa.c | 1 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/efifb.c | 11 +- drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/binfmt_misc.c | 4 +- fs/btrfs/disk-io.c | 23 -- fs/btrfs/extent_io.c | 5 +- fs/btrfs/extent_io.h | 3 +- fs/btrfs/inode.c | 2 +- fs/btrfs/send.c | 4 + fs/ceph/xattr.c | 1 + fs/cifs/cifs_spnego.c | 16 + fs/cifs/fs_context.c | 4 + fs/cifs/smb2misc.c | 2 + fs/debugfs/file.c | 5 +- fs/dlm/lock.c | 5 +- fs/dlm/midcomms.c | 7 + fs/eventpoll.c | 201 ++++++---- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 4 +- fs/f2fs/data.c | 13 +- fs/f2fs/super.c | 8 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 37 +- fs/gfs2/glops.c | 40 +- fs/gfs2/log.c | 33 +- fs/gfs2/util.c | 30 +- fs/gfs2/xattr.c | 28 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/ksmbd/auth.c | 11 +- fs/ksmbd/mgmt/user_session.c | 12 +- fs/ksmbd/smb2pdu.c | 11 +- fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/fslog.c | 12 +- fs/ntfs3/record.c | 63 +++- fs/ntfs3/run.c | 18 +- fs/ntfs3/super.c | 7 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/aops.c | 75 ++-- fs/ocfs2/cluster/nodemanager.c | 2 +- fs/ocfs2/dir.c | 4 +- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/file.c | 4 +- fs/ocfs2/inode.c | 33 +- fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/localalloc.c | 6 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/namei.c | 2 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 6 +- fs/omfs/inode.c | 6 + fs/pstore/inode.c | 10 +- fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 +- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 5 + include/linux/cdrom.h | 1 + include/linux/cpufreq.h | 5 +- include/linux/dev_printk.h | 10 + include/linux/device.h | 48 ++- include/linux/dmi.h | 5 + include/linux/fsl/mc.h | 6 +- include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 41 ++- include/linux/kvm_host.h | 3 +- include/linux/module.h | 2 + include/linux/moduleparam.h | 11 +- include/linux/netfilter/x_tables.h | 3 +- include/linux/netfilter_arp/arp_tables.h | 6 +- include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/linux/padata.h | 4 - include/linux/ppp_defs.h | 30 ++ include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/skbuff.h | 12 + include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/sunrpc/xprt.h | 3 + include/linux/sunrpc/xprtsock.h | 1 - include/linux/tpm_eventlog.h | 9 +- include/linux/uprobes.h | 1 + include/linux/usb.h | 3 +- include/net/bluetooth/hci_core.h | 2 + include/net/flow_dissector.h | 22 ++ include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/netfilter/nf_queue.h | 1 + include/net/netfilter/nf_tables.h | 2 + include/net/pie.h | 2 +- include/net/red.h | 1 - include/net/route.h | 6 - include/net/udp_tunnel.h | 15 + include/trace/events/btrfs.h | 9 +- include/trace/events/rxrpc.h | 8 + include/uapi/linux/mii.h | 3 +- include/video/udlfb.h | 1 + io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 37 +- kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/bpf_lsm.c | 2 +- kernel/bpf/devmap.c | 8 +- kernel/bpf/local_storage.c | 2 +- kernel/bpf/verifier.c | 3 + kernel/cgroup/rdma.c | 2 +- kernel/events/uprobes.c | 10 +- kernel/fork.c | 11 +- kernel/module.c | 4 +- kernel/padata.c | 136 ++----- kernel/params.c | 46 +-- kernel/taskstats.c | 1 + kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 92 +++-- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 ++- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/af_bluetooth.c | 10 +- net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_core.c | 34 +- net/bluetooth/hci_event.c | 3 - net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 9 + net/bpf/test_run.c | 20 +- net/bridge/br_multicast.c | 27 +- net/bridge/netfilter/Kconfig | 13 + net/bridge/netfilter/Makefile | 2 +- net/bridge/netfilter/ebtable_broute.c | 14 +- net/bridge/netfilter/ebtable_filter.c | 14 +- net/bridge/netfilter/ebtable_nat.c | 12 +- net/bridge/netfilter/ebtables.c | 71 ++-- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/auth.c | 4 +- net/ceph/crush/crush.c | 6 +- net/ceph/mon_client.c | 2 + net/ceph/osdmap.c | 14 +- net/core/filter.c | 17 +- net/core/flow_dissector.c | 79 +++- net/core/rtnetlink.c | 1 + net/ethtool/bitset.c | 8 +- net/ipv4/icmp.c | 12 +- net/ipv4/inet_connection_sock.c | 5 +- net/ipv4/netfilter/Kconfig | 59 ++- net/ipv4/netfilter/Makefile | 2 +- net/ipv4/netfilter/arp_tables.c | 43 ++- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/netfilter/arptable_filter.c | 14 +- net/ipv4/netfilter/ip_tables.c | 18 +- net/ipv4/netfilter/iptable_filter.c | 4 +- net/ipv4/netfilter/iptable_mangle.c | 4 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 4 +- net/ipv4/netfilter/iptable_security.c | 4 +- net/ipv4/nexthop.c | 4 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 --- net/ipv4/tcp.c | 3 +- net/ipv4/udp_tunnel_core.c | 48 +++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 ---- net/ipv6/ip6_udp_tunnel.c | 69 ++++ net/ipv6/netfilter/Kconfig | 30 +- net/ipv6/netfilter/Makefile | 2 +- net/ipv6/netfilter/ip6_tables.c | 18 +- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/netfilter/ip6table_filter.c | 4 +- net/ipv6/netfilter/ip6table_mangle.c | 4 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 4 +- net/ipv6/netfilter/ip6table_security.c | 4 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tdls.c | 2 +- net/mac80211/tx.c | 4 +- net/mptcp/pm_netlink.c | 2 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/Kconfig | 22 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 152 ++++++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nf_queue.c | 4 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 +-- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_dynset.c | 10 +- net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo.c | 20 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/x_tables.c | 116 +++++- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/netfilter/xt_socket.c | 23 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 9 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 8 +- net/sched/cls_u32.c | 13 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 28 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_gred.c | 3 - net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 57 ++- net/sched/sch_pie.c | 52 ++- net/sched/sch_red.c | 34 +- net/sched/sch_sfb.c | 54 +-- net/sched/sch_taprio.c | 238 ++++++------ net/sctp/inqueue.c | 1 + net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/sunrpc/sysfs.c | 60 +-- net/sunrpc/xprtsock.c | 33 +- net/tipc/msg.c | 14 +- net/tls/tls_sw.c | 26 +- net/unix/diag.c | 21 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 3 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 4 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - security/integrity/ima/ima_crypto.c | 2 +- sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 7 - sound/core/control.c | 4 + sound/core/control_led.c | 14 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/isa/sc6000.c | 285 ++++++++------- sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_conexant.c | 35 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++++-- sound/soc/fsl/fsl_xcvr.c | 22 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 39 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 88 ++++- sound/usb/midi.c | 22 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/quirks.c | 38 +- sound/usb/stream.c | 4 +- tools/lib/bpf/relo_core.c | 2 + tools/perf/util/branch.h | 3 + tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 51 +-- tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 37 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- .../testing/selftests/mqueue/{setting => settings} | 0 virt/kvm/dirty_ring.c | 3 +- 692 files changed, 6912 insertions(+), 3309 deletions(-)

4 months

[PATCH 5.10 000/589] 5.10.258-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.258 release. There are 589 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 01 Jun 2026 16:01:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.258-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.258-rc1 Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: Fix double free issue with interrupt buffer allocation Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: cdev: check if uAPI v2 config attributes are correctly zeroed Andy Shevchenko <andy.shevchenko(a)gmail.com> gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) Jani Nikula <jani.nikula(a)intel.com> string: add mem_is_zero() helper to check if memory area is all zeros Rosen Penev <rosenp(a)gmail.com> net: ag71xx: check error for platform_get_irq David Carlier <devnexen(a)gmail.com> tracing: Avoid NULL return from hist_field_name() on truncation Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Jakub Kicinski <kuba(a)kernel.org> net: tls: prevent chain-after-chain in plain text SG Jakub Kicinski <kuba(a)kernel.org> net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring Chenguang Zhao <zhaochenguang(a)kylinos.cn> ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics Lukas Bulwahn <lukas.bulwahn(a)redhat.com> HID: quirks: really enable the intended work around for appledisplay Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Carry over frag counter Andreas Haarmann-Thiemann <eitschman(a)nebelreich.de> net: ethernet: cortina: Drop half-assembled SKB Linus Walleij <linusw(a)kernel.org> net: ethernet: cortina: Make RX SKB per-port Rosen Penev <rosenp(a)gmail.com> irqchip/ath79-cpu: Remove unused function Gabor Juhos <j4g8y7(a)gmail.com> phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access Bart Van Assche <bvanassche(a)acm.org> ice: fix locking in ice_dcb_rebuild() Guenter Roeck <linux(a)roeck-us.net> ARM: integrator: Fix early initialization David Gow <david(a)davidgow.net> kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS David Gow <david(a)davidgow.net> kunit: config: Enable KUNIT_DEBUGFS by default Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) reject implausible blackbox record_count Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) seed timestamp from the real-time clock Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative tt_buff_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: fix negative last_changeset_len Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid use of uninit sender vars Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix report_work leak on backbone_gw purge Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: disallow unicast fragment in fragment Luxiao Xu <rakukuip(a)gmail.com> batman-adv: fix tp_meter counter underflow during shutdown Ruide Cao <caoruide123(a)gmail.com> batman-adv: fix fragment reassembly length accounting Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: handle forward allocation error Ruijie Li <ruijieli51(a)gmail.com> batman-adv: clear current gateway during teardown Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: fix use-after-free in orig_node RCU release Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix integer overflow in bios_get_image() Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/bridge: megachips: remove bridge when irq request fails Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: Reject MPA FPDU length underflow before signed receive math Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix use-after-free after DMA setup failure Johan Hovold <johan(a)kernel.org> spi: sprd: fix error pointer deref after DMA setup failure Michael Bommarito <michael.bommarito(a)gmail.com> scsi: isci: Fix use-after-free in device removal path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Do not call map->ops->elt_free() if elt_alloc() fails John Walker <johnwalker0(a)gmail.com> wifi: cfg80211: advance loop vars in cfg80211_merge_profile() Michael Bommarito <michael.bommarito(a)gmail.com> ixgbevf: fix use-after-free in VEPA multicast source pruning Michael Bommarito <michael.bommarito(a)gmail.com> ipv4: raw: reject IP_HDRINCL packets with ihl < 5 Kyle Farnung <kfarnung(a)gmail.com> wifi: ath11k: clear shared SRNG pointer state on restart Minh Nguyen <minhnguyen.080505(a)gmail.com> vsock/vmci: fix UAF when peer resets connection during handshake Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Fix reporting of missed events in iterator Nan Li <tonanli66(a)gmail.com> netfilter: ipset: stop hash:* range iteration at end Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_hbh: reject oversized option lists Nicolai Buchwitz <nb(a)tipi-net.de> net: bcmgenet: keep RBUF EEE/PM disabled Zijing Yin <yzjaurora(a)gmail.com> phonet/pep: disable BH around forwarded sk_receive_skb() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Jann Horn <jannh(a)google.com> Bluetooth: bnep: Fix UAF read of dev->name Takashi Iwai <tiwai(a)suse.de> ALSA: asihpi: Fix potential OOB array access at reading cache Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: ua101: Reject too-short USB descriptors Abdurrahman Hussain <abdurrahman(a)nexthop.ai> hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sysfs: don't remove existing directory on update failure Asim Viladi Oglu Manizada <manizada(a)pm.me> smb: client: reject userspace cifs.spnego descriptions Ben Hutchings <benh(a)debian.org> Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() Sasha Levin <sashal(a)kernel.org> Revert "x86/vdso: Fix output operand size of RDPID" Kees Cook <keescook(a)chromium.org> selftests: lib.mk: Also install "config" and "settings" Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Allison Henderson <achender(a)kernel.org> net/rds: reset op_nents when zerocopy page pin fails Nicholas Carlini <nicholas(a)carlini.com> io-wq: check that the predecessor is hashed in io_wq_remove_pending() Johan Hovold <johan(a)kernel.org> drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Gyeyoung Baek <gye976(a)gmail.com> drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Naval Alcalá <ari(a)naval.cat> iommu/vt-d: Disable DMAR for Intel Q35 IGFX Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: handle rbtree insertion error in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in crush_decode() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential null-ptr-deref in decode_choose_args() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in osdmap_decode() Ma Ke <make24(a)iscas.ac.cn> powerpc/warp: Fix error handling in pika_dtm_thread Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> ceph: fix a buffer leak in __ceph_setxattr() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Bound MIDI endpoint descriptor scans Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Sergio Correia <scorreia(a)redhat.com> audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV Zoran Ilievski <goodboy(a)rexbytes.com> net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled Li Xiasong <lixiasong1(a)huawei.com> netfilter: nft_ct: fix missing expect put in obj eval Sergio Correia <scorreia(a)redhat.com> audit: fix incorrect inheritable capability in CAPSET records Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Cap AEAD AD length to 0x80000000 Alexandre Belloni <alexandre.belloni(a)bootlin.com> alarmtimer: Check RTC features instead of ops Alexandre Belloni <alexandre.belloni(a)bootlin.com> rtc: allow rtc_read_alarm without read_alarm callback Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate more data-races in pie_dump_stats() Qingqing Yang <qingqing.yang(a)broadcom.com> flow_dissector: Do not count vlan tags inside tunnel payload Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Yannick Vignon <yannick.vignon(a)nxp.com> net/sched: taprio: Fix init procedure Filipe Manana <fdmanana(a)suse.com> btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Read EDID from VBIOS embedded panel info Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Allow DCE link encoder without AUX registers Eric Dumazet <edumazet(a)google.com> net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) Weiming Shi <bestswngs(a)gmail.com> bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() Beniamino Galvani <b.galvani(a)gmail.com> ipv6: rename and move ip6_dst_lookup_tunnel() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: add new arguments to udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: remove "proto" argument from udp_tunnel_dst_lookup() Beniamino Galvani <b.galvani(a)gmail.com> ipv4: rename and move ip_route_output_tunnel() Xin Long <lucien.xin(a)gmail.com> sctp: discard stale INIT after handshake completion Xin Long <lucien.xin(a)gmail.com> netfilter: skip recording stale or retransmitted INIT Christian A. Ehrhardt <christian.ehrhardt(a)codasip.com> ASoC: codecs: ab8500: Fix casting of private data Heiko Schocher <hs(a)nabladev.com> net: phy: dp83869: fix setting CLK_O_SEL field. Paul Geurts <paul.geurts(a)prodrive-technologies.com> NFC: trf7970a: Ignore antenna noise when checking for RF field Morduan Zang <zhangdandan(a)uniontech.com> net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit Zhan Jun <zhanjun(a)uniontech.com> net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() Ido Schimmel <idosch(a)nvidia.com> vrf: Fix a potential NPD when removing a port from a VRF Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_choke: annotate data-races in choke_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: choke: remove unused variables in struct choke_sched_data Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: validate slot configuration Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger <stephen(a)networkplumber.org> net/sched: netem: fix probability gaps in 4-state loss model Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> net: sched: sch_netem: Refactor code in 4-state loss generator Nikola Z. Ivanov <zlatistiv(a)gmail.com> netdevsim: zero initialize struct iphdr in dummy sk_buff Daan De Meyer <daan(a)amutable.com> cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() Enze Li <lienze(a)kylinos.cn> scsi: sr: Add memory allocation failure handling for get_capabilities() Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: don't use simple_strtoul Jiexun Wang <wangjiexun2025(a)gmail.com> netfilter: xt_policy: fix strict mode inbound policy matching Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: arp_tables: fix IEEE1394 ARP payload parsing Breno Leitao <leitao(a)debian.org> tracing: branch: Fix inverted check on stat tracer registration Mark Harmstone <mark(a)harmstone.com> btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() Qu Wenruo <wqu(a)suse.com> btrfs: merge PAGE_CLEAR_DIRTY and PAGE_SET_WRITEBACK to PAGE_START_WRITEBACK Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: make data_ready a per-instance variable Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: initialize struct earlier Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: don't free the reused channel Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: add sanity check for channel array cuitao <cuitao(a)kylinos.cn> cgroup/rdma: fix integer overflow in rdmacg_try_charge() Wolfram Sang <wsa+renesas(a)sang-engineering.com> mailbox: mailbox-test: free channels on probe error Yuho Choi <dbgh9129(a)gmail.com> fbdev: offb: fix PCI device reference leak on probe failure Anthony Pighin (Nokia) <anthony.pighin(a)nokia.com> rtc: abx80x: Disable alarm feature if no interrupt attached Alexandre Belloni <alexandre.belloni(a)bootlin.com> rtc: introduce features bitfield Bae Yeonju <iwasbaeyz(a)gmail.com> fs/adfs: validate nzones in adfs_validate_bblk() Kohei Enju <kohei(a)enjuk.jp> vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() Lee Jones <lee(a)kernel.org> tipc: fix double-free in tipc_buf_append() Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> nfp: fix swapped arguments in nfp_encode_basic_qdr() calls Eric Dumazet <edumazet(a)google.com> net/sched: sch_sfb: annotate data-races in sfb_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_red: annotate data-races in red_dump_stats() Zhengchao Shao <shaozhengchao(a)huawei.com> net: sched: gred/red: remove unused variables in struct red_stats Eric Dumazet <edumazet(a)google.com> net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() Eric Dumazet <edumazet(a)google.com> net/sched: sch_pie: annotate data-races in pie_dump_stats() Eric Dumazet <edumazet(a)google.com> net_sched: sch_hhf: annotate data-races in hhf_dump_stats() Michael Bommarito <michael.bommarito(a)gmail.com> net/rds: zero per-item info buffer before handing it to visitors Jun Yan <jerrysteve1101(a)gmail.com> arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Weiming Shi <bestswngs(a)gmail.com> slip: bound decode() reads against the compressed packet length Weiming Shi <bestswngs(a)gmail.com> slip: reject VJ receive packets on instances with no rstate array Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nfnetlink_osf: fix out-of-bounds read on option matching Yingnan Zhang <342144303(a)qq.com> ipvs: fix MTU check for GSO packets in tunnel mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xtables: restrict several matches to inet family Florian Westphal <fw(a)strlen.de> netfilter: conntrack: remove sprintf usage Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_osf: restrict it to ipv4 Weiming Shi <bestswngs(a)gmail.com> openvswitch: cap upcall PID array size and pre-size vport replies Qingfang Deng <qingfang.deng(a)linux.dev> pppoe: drop PFC frames Wojciech Drewek <wojciech.drewek(a)intel.com> flow_dissector: Add PPPoE dissectors Boris Sukholitko <boris.sukholitko(a)broadcom.com> flow_dissector: Add number of vlan tags dissector Boris Sukholitko <boris.sukholitko(a)broadcom.com> dissector: do not set invalid PPP protocol Michael Bommarito <michael.bommarito(a)gmail.com> sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in icmpv6_rcv() Matt Vollrath <tactii(a)gmail.com> e1000e: Unroll PTP in probe error handling Kohei Enju <kohei(a)enjuk.jp> i40e: don't advertise IFF_SUPP_NOFCS Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) Vinicius Costa Gomes <vinicius.gomes(a)intel.com> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: rename close_time to end_time Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: refactor one skb dequeue from TXQ to separate function Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: continue with other TXQs if one dequeue() failed Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: replace safety precautions with comments Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: stop going through private ops for dequeue and peek Yannick Vignon <yannick.vignon(a)nxp.com> net: taprio offload: enforce qdisc to netdev queue mapping Kurt Kanzenbach <kurt(a)linutronix.de> taprio: Handle short intervals and large packets Jiayuan Chen <jiayuan.chen(a)linux.dev> nexthop: fix IPv6 route referencing IPv4 nexthop Ido Schimmel <idosch(a)nvidia.com> nexthop: Emit a notification when a nexthop group is modified Dudu Lu <phx0fer(a)gmail.com> net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys René Rebe <rene(a)exactco.de> PCMCIA: Fix garbled log messages for KERN_CONT Paul Moses <p(a)1g4.org> crypto: ccp - copy IV using skcipher ivsize T Pratham <t-pratham(a)ti.com> crypto: sa2ul - Fix AEAD fallback algorithm names Geert Uytterhoeven <geert+renesas(a)glider.be> lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> clk: qcom: dispcc-sc7180: Add missing MDSS resets Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets Geert Uytterhoeven <geert+renesas(a)glider.be> clk: xgene: Fix mapping leak in xgene_pllclk_init() Arnd Bergmann <arnd(a)arndb.de> clk: qoriq: avoid format string warning Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> clk: imx8mq: Correct the CSI PHY sels Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() Felix Gu <ustc.gu(a)gmail.com> clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Val Packett <val(a)packett.cool> clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk Junrui Luo <moonafterrain(a)outlook.com> scsi: target: core: Fix integer overflow in UNMAP bounds check Yang Erkun <yangerkun(a)huawei.com> scsi: sg: Resolve soft lockup issue when opening /dev/sgX Florian Westphal <fw(a)strlen.de> RDMA/core: Prefer NLA_NUL_STRING Fedor Pchelkin <pchelkin(a)ispras.ru> platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() Randy Dunlap <rdunlap(a)infradead.org> tty: hvc_iucv: fix off-by-one in number of supported devices наб <nabijaczleweli(a)nabijaczleweli.xyz> tty: hvc: remove HVC_IUCV_MAGIC Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> platform/surface: surfacepro3_button: Drop wakeup source on remove Chen Ni <nichen(a)iscas.ac.cn> backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() Nuno Sa <nuno.sa(a)analog.com> dev_printk: add new dev_err_probe() helpers Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Move dev_err_probe() to where it belogs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: device.h: remove extern from function prototypes Arnaldo Carvalho de Melo <acme(a)redhat.com> perf util: Kill die() prototype, dead for a long time Leo Yan <leo.yan(a)arm.com> perf expr: Return -EINVAL for syntax error in expr__find_ids() Yu-Chun Lin <eleanor15x(a)gmail.com> pinctrl: abx500: Fix type of 'argument' variable Ian Rogers <irogers(a)google.com> perf branch: Avoid incrementing NULL Ethan Tidmore <ethantidmore06(a)gmail.com> pinctrl: pinctrl-pic32: Fix resource leak Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix precedence bug in convert_bpf_ld_abs alignment check Oliver Neukum <oneukum(a)suse.com> HID: usbhid: fix deadlock in hid_post_reset() Richard Genoud <richard.genoud(a)bootlin.com> mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob Chen Ni <nichen(a)iscas.ac.cn> mtd: physmap_of_gemini: Fix disabled pinctrl state check Denis Benato <denis.benato(a)linux.dev> HID: asus: do not abort probe when not necessary Denis Benato <denis.benato(a)linux.dev> HID: asus: make asus_resume adhere to linux kernel coding standards Daniel Hodges <hodgesd(a)meta.com> ima: check return value of crypto_shash_final() in boot aggregate Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing: Rebuild full_name on each hist_field_name() call Frank Li <Frank.Li(a)nxp.com> dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate group add input before caching ZhengYuan Huang <gality369(a)gmail.com> ocfs2: validate bg_bits during freefrag scan ZhengYuan Huang <gality369(a)gmail.com> ocfs2: fix listxattr handling when the buffer is full Alok Tiwari <alok.a.tiwari(a)oracle.com> soc: qcom: aoss: compare against normalized cooling state Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison Junrui Luo <moonafterrain(a)outlook.com> ocfs2/dlm: validate qr_numregions in dlm_match_regions() David Heidelberg <david(a)ixit.cz> arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot Sumit Semwal <sumit.semwal(a)linaro.org> arm64: dts: qcom: sdm845-xiaomi-beryllium: Add DSI and panel bits Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra30-emc: Fix dll_change check Mikko Perttunen <mperttunen(a)nvidia.com> memory: tegra124-emc: Fix dll_change check Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: mediatek: mt7623: fix efuse fallback compatible Thomas Huth <thuth(a)redhat.com> efi/capsule-loader: fix incorrect sizeof in phys array reallocation Jan Kara <jack(a)suse.cz> quota: Fix race of dquot_scan_active() with quota deactivation Ricardo B. Marlière <rbm(a)suse.com> ktest: Run POST_KTEST hooks on failure and cancellation Ricardo B. Marlière <rbm(a)suse.com> ktest: Honor empty per-test option overrides Ricardo B. Marlière <rbm(a)suse.com> ktest: Avoid undef warning when WARNINGS_FILE is unset Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Disable direct speed change for Endpoint mode Vidya Sagar <vidyas(a)nvidia.com> PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" Waiman Long <longman(a)redhat.com> selftest: memcg: skip memcg_sock test if address family not supported Jane Chu <jane.chu(a)oracle.com> Documentation: fix a hugetlbfs reservation statement Gerd Bayer <gbayer(a)linux.ibm.com> PCI: Enable AtomicOps only if Root Port supports them Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Change the type for iec958 channel status controls Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Felix Gu <gu_0233(a)qq.com> pmdomain: ti: omap_prm: Fix a reference leak on device node Akhil P Oommen <akhilpo(a)oss.qualcomm.com> drm/msm/a6xx: Use barriers while updating HFI Q headers Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm/a6xx: Fix HLSQ register dumping Lei Huang <huanglei(a)kylinos.cn> ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Whitespace fix Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fill DW8 fields from SMC Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Validate compress device numbers without dynamic minors Takashi Iwai <tiwai(a)suse.de> ALSA: compress: Drop unused functions Sebastian Reichel <sebastian.reichel(a)collabora.com> drm/panel: simple: Correct G190EAN01 prepare timing Alexander Koskovich <akoskovich(a)pm.me> drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Ethan Tidmore <ethantidmore06(a)gmail.com> drm/sun4i: Fix resource leaks Felix Gu <ustc.gu(a)gmail.com> spi: fsl-qspi: Use reinit_completion() for repeated operations Junrui Luo <moonafterrain(a)outlook.com> dm log: fix out-of-bounds write due to region_count overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache metadata: fix memory leak on metadata abort retry Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix dirty mapping checking in passthrough mode switching Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: support shrinking the origin device Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix concurrent write failure in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache policy smq: fix missing locks in invalidating cache blocks Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix write path cache coherency in passthrough mode Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix null-deref with concurrent writes in passthrough mode Sander Vanheule <sander(a)svanheule.net> ASoC: sti: use managed regmap_field allocations Sander Vanheule <sander(a)svanheule.net> ASoC: sti: Return errors from regmap_field_alloc() Alexander Konyukhov <Alexander.Konyukhov(a)kaspersky.com> drm/komeda: fix integer overflow in AFBC framebuffer size check Dudu Lu <phx0fer(a)gmail.com> Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU Sun Jian <sun.jian.kdev(a)gmail.com> bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb Taegu Ha <hataegu0826(a)gmail.com> ppp: require CAP_NET_ADMIN in target netns for unattached ioctls Greg Jumper <greg.jumper(a)oracle.com> net/rds: Restrict use of RDS/IB to the initial network namespace Håkon Bugge <haakon.bugge(a)oracle.com> net/rds: Optimize rds_ib_laddr_check Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_ct: Only release RCU read lock after ct_ft Mashiro Chen <mashiro.chen(a)mailbox.org> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf Jiri Slaby (SUSE) <jirislaby(a)kernel.org> 6pack: propagage new tty types Florian Westphal <fw(a)strlen.de> netfilter: nft_fwd_netdev: check ttl/hl before forwarding Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: fix off-by-one in bcmgenet_put_txcb Ethan Tidmore <ethantidmore06(a)gmail.com> wifi: brcmfmac: Fix error pointer dereference Arend van Spriel <arend.vanspriel(a)broadcom.com> brcmfmac: support chipsets with different core enumeration space Weiming Shi <bestswngs(a)gmail.com> bpf: fix end-of-list detection in cgroup_storage_get_next_key() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: fix backup region offset update to elfcorehdr Duoming Zhou <duoming(a)zju.edu.cn> wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet Zilin Guan <zilin(a)seu.edu.cn> wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() Mario Limonciello (AMD) <superm1(a)kernel.org> firmware: dmi: Correct an indexing error in dmi.h Bart Van Assche <bvanassche(a)acm.org> locking: Fix rwlock support in <linux/spinlock_up.h> Brian Masney <bmasney(a)redhat.com> irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter Gopi Krishna Menon <krishnagopi487(a)gmail.com> thermal/drivers/spear: Fix error condition for reading st,thermal-flags Danilo Krummrich <dakr(a)kernel.org> devres: fix missing node debug info in devm_krealloc() Cole Leavitt <cole(a)unwrap.rs> pstore/ram: fix resource leak when ioremap() fails Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() Bart Van Assche <bvanassche(a)acm.org> drbd: Balance RCU calls in drbd_adm_dump_devices() HyungJung Joo <jhj140711(a)gmail.com> fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix uninitialized closure object Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Corey Minyard <corey(a)minyard.net> ipmi:ssif: NULL thread on error Corey Minyard <corey(a)minyard.net> ipmi:ssif: Remove unnecessary indention Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix backport of io_poll_add() changes Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Sasha Levin <sashal(a)kernel.org> Revert "riscv: Sparse-Memory/vmemmap out-of-bounds fix" Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix connections leak when tlink setup failed David Howells <dhowells(a)redhat.com> rxrpc: Fix recvmsg() unconditional requeue Sasha Levin <sashal(a)kernel.org> Revert "scsi: ufs: core: Improve SCSI abort handling" Jamie Iles <quic_jiles(a)quicinc.com> i3c: fix uninitialized variable use in i2c setup Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Nathan Chancellor <nathan(a)kernel.org> drm/amd/display: Do not add '-mhard-float' to calcs, dsc, and dcn30 FP files for clang Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Set the DVS voltages lower Martin Kepplinger <martink(a)posteo.de> arm64: dts: imx8mq-librem5: set regulators boot-on Guido Günther <agx(a)sigxcpu.org> arm64: dts: imx8mq-librem5: Don't mark buck3 as always on Martin Kepplinger <martink(a)posteo.de> arm64: dts: imx8mq-librem5-r3: workaround i2c1 issue with 1GHz cpu voltage Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write hongnanli <hongnan.li(a)linux.alibaba.com> fs/ocfs2: fix comments mentioning i_mutex Oleg Nesterov <oleg(a)redhat.com> x86/uprobes: Fix XOL allocation failure for 32-bit tasks David Gow <davidgow(a)google.com> drivers: base: Free devm resources when unregistering a device Keith Busch <kbusch(a)kernel.org> blk-mq: use quiesced elevator switch when reinitializing queues Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Joonwon Kang <joonwonkang(a)google.com> mailbox: Prevent out-of-bounds access in of_mbox_index_xlate() Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Leonid Ravich <lravich(a)gmail.com> IB/mad: Don't call to function that might sleep while in atomic context Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Improve SCSI abort handling Chengfeng Ye <cyeaa(a)connect.ust.hk> ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Waiman Long <longman(a)redhat.com> blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Lee, Chun-Yi <joeyli.kernel(a)gmail.com> thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Yongzhi Liu <lyz_cs(a)pku.edu.cn> drm/amd/display: Fix memory leak Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Alex Hung <alex.hung(a)amd.com> drm/amd/display: Add null checker before passing variables Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Liu Jian <liujian56(a)huawei.com> bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> net/sched: act_ct: fix ref leak when switching zones Arun Easi <aeasi(a)marvell.com> scsi: qla2xxx: Fix crash when I/O abort times out Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix warning message due to adisc being flushed Cezar Bulinaru <cbulinaru(a)gmail.com> net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Allow extra entities Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> ACPI: property: Constify stubs for CONFIG_ACPI=n case Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Peng Li <lipeng321(a)huawei.com> net: lapbether: replace comparison to NULL with "lapbeth_get_x25_dev" Peng Li <lipeng321(a)huawei.com> net: lapbether: remove trailing whitespaces Xie He <xie.he.0141(a)gmail.com> net: lapbether: Close the LAPB device before its underlying Ethernet device closes Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning ------------- Diffstat: Documentation/vm/hugetlbfs_reserv.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/mt7623.dtsi | 2 +- arch/arm/mach-integrator/integrator_cp.c | 13 +- .../boot/dts/amlogic/meson-gxl-s905d-p230.dts | 3 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 6 + arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 16 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 72 ++++ arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 299 ++++++++++++++--- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 20 +- arch/powerpc/platforms/44x/warp.c | 2 + arch/riscv/include/asm/pgtable.h | 2 +- arch/s390/kernel/debug.c | 8 + arch/um/drivers/cow_user.c | 8 +- arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/uprobes.c | 24 ++ arch/x86/kvm/svm/nested.c | 11 + arch/x86/kvm/svm/sev.c | 11 +- arch/x86/kvm/svm/svm.c | 10 + arch/x86/kvm/x86.c | 14 +- block/blk-cgroup.c | 4 + block/blk-mq.c | 6 +- block/blk.h | 3 +- block/elevator.c | 4 +- crypto/af_alg.c | 2 + crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/video_detect.c | 8 + drivers/ata/ahci.c | 14 + drivers/base/core.c | 26 ++ drivers/base/dd.c | 12 + drivers/base/devres.c | 2 + drivers/block/drbd/drbd_nl.c | 8 +- drivers/bluetooth/hci_ldisc.c | 51 ++- drivers/cdrom/cdrom.c | 73 ++-- drivers/char/ipmi/ipmi_si_intf.c | 70 +++- drivers/char/ipmi/ipmi_ssif.c | 74 +++- drivers/char/tpm/tpm_tis_core.c | 4 + drivers/clk/clk-qoriq.c | 17 +- drivers/clk/clk-xgene.c | 2 + drivers/clk/imx/clk-imx6q.c | 12 +- drivers/clk/imx/clk-imx8mq.c | 4 +- drivers/clk/qcom/dispcc-sc7180.c | 8 + drivers/clk/qcom/dispcc-sm8250.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccp/ccp-crypto-aes.c | 7 +- drivers/crypto/ccp/sev-dev.c | 19 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/sa2ul.c | 4 +- drivers/dma/mxs-dma.c | 1 + drivers/firmware/efi/capsule-loader.c | 2 +- drivers/firmware/google/framebuffer-coreboot.c | 2 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 66 ++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 72 +++- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 62 ++++ .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 3 +- .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 4 +- drivers/gpu/drm/amd/display/dc/dcn30/Makefile | 4 +- drivers/gpu/drm/amd/display/dc/dsc/Makefile | 3 +- .../amd/display/include/grph_object_ctrl_defs.h | 4 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 15 + .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 28 +- .../drm/arm/display/komeda/komeda_framebuffer.c | 6 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 14 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_cfg.h | 2 +- drivers/gpu/drm/panel/panel-simple.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-asus.c | 28 +- drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 3 +- drivers/hid/hid-roccat.c | 2 + drivers/hid/usbhid/hid-core.c | 2 +- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/i3c/master.c | 7 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/core/iwpm_msg.c | 6 +- drivers/infiniband/core/mad.c | 5 - drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/iommu/intel/iommu.c | 3 + drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/irqchip/irq-pic32-evic.c | 2 +- drivers/mailbox/mailbox-test.c | 39 ++- drivers/mailbox/mailbox.c | 9 +- drivers/md/bcache/super.c | 8 + drivers/md/dm-cache-metadata.c | 24 +- drivers/md/dm-cache-metadata.h | 5 - drivers/md/dm-cache-policy-smq.c | 4 + drivers/md/dm-cache-target.c | 111 ++++-- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-log.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/raid10.c | 2 + drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 +-- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/media/usb/uvc/uvc_driver.c | 81 +++-- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/media/usb/uvc/uvcvideo.h | 9 +- drivers/memory/tegra/tegra124-emc.c | 2 +- drivers/memory/tegra/tegra30-emc.c | 6 +- drivers/mfd/mc13xxx-core.c | 2 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/maps/physmap-gemini.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 6 +- drivers/net/bareudp.c | 24 +- drivers/net/can/spi/mcp251x.c | 29 +- drivers/net/dsa/sja1105/sja1105_static_config.c | 6 +- .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 15 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 1 - drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + .../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +- drivers/net/hamradio/6pack.c | 39 ++- drivers/net/netdevsim/dev.c | 2 +- drivers/net/phy/dp83869.c | 13 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/ppp/pppoe.c | 8 +- drivers/net/slip/slhc.c | 49 ++- drivers/net/tap.c | 23 +- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/usb/lan78xx.c | 31 +- drivers/net/usb/rtl8150.c | 12 +- drivers/net/vrf.c | 15 +- drivers/net/wan/lapbether.c | 23 +- drivers/net/wireless/ath/ath11k/hal.c | 14 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/ath/ath9k/channel.c | 6 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 31 +- .../wireless/broadcom/brcm80211/brcmfmac/chip.h | 5 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 +- .../net/wireless/broadcom/brcm80211/include/soc.h | 2 +- drivers/net/wireless/mac80211_hwsim.c | 1 - drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/trf7970a.c | 3 +- drivers/nvme/target/core.c | 2 +- drivers/parisc/lasi.c | 12 +- drivers/pci/controller/dwc/pcie-tegra194.c | 10 +- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/pci.c | 48 ++- drivers/pci/pcie/aer.c | 2 - drivers/pcmcia/rsrc_nonstatic.c | 6 +- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/pinctrl/nomadik/pinctrl-abx500.c | 2 +- drivers/pinctrl/pinctrl-pic32.c | 20 +- drivers/platform/x86/dell_rbu.c | 6 +- drivers/platform/x86/intel-hid.c | 6 +- drivers/platform/x86/surfacepro3_button.c | 1 + drivers/power/supply/max17042_battery.c | 2 +- drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/rtc/class.c | 5 + drivers/rtc/interface.c | 12 +- drivers/rtc/rtc-abx80x.c | 2 + drivers/s390/cio/css.c | 2 +- drivers/scsi/isci/host.c | 3 + drivers/scsi/qla2xxx/qla_init.c | 20 +- drivers/scsi/sg.c | 29 +- drivers/scsi/sr.c | 25 +- drivers/scsi/sr.h | 1 - drivers/soc/qcom/ocmem.c | 7 +- drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/ti/omap_prm.c | 1 + drivers/spi/spi-fsl-qspi.c | 3 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-orion.c | 6 + drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/target/target_core_configfs.c | 2 +- drivers/target/target_core_sbc.c | 3 +- .../intel/int340x_thermal/int3400_thermal.c | 9 +- drivers/thermal/spear_thermal.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/tty/hvc/hvc_iucv.c | 11 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 6 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 + drivers/vhost/net.c | 4 +- drivers/video/backlight/sky81452-backlight.c | 3 + drivers/video/fbdev/matrox/g450_pll.c | 2 +- drivers/video/fbdev/offb.c | 7 +- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 34 +- fs/adfs/super.c | 3 + fs/btrfs/extent_io.c | 4 +- fs/btrfs/extent_io.h | 12 +- fs/btrfs/inode.c | 30 +- fs/ceph/xattr.c | 1 + fs/cifs/cifs_spnego.c | 16 + fs/cifs/connect.c | 17 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 4 +- fs/fuse/control.c | 4 +- fs/fuse/readdir.c | 4 + fs/gfs2/dir.c | 6 +- fs/gfs2/glops.c | 4 + fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/nfs/blocklayout/blocklayout.c | 4 +- fs/nilfs2/dat.c | 3 + fs/nilfs2/ioctl.c | 6 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ocfs2/alloc.c | 2 +- fs/ocfs2/aops.c | 75 +++-- fs/ocfs2/cluster/nodemanager.c | 2 +- fs/ocfs2/dir.c | 4 +- fs/ocfs2/dlm/dlmdomain.c | 10 +- fs/ocfs2/file.c | 4 +- fs/ocfs2/inode.c | 33 +- fs/ocfs2/ioctl.c | 18 +- fs/ocfs2/localalloc.c | 6 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/namei.c | 2 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/resize.c | 22 +- fs/ocfs2/xattr.c | 6 +- fs/omfs/inode.c | 6 + fs/pstore/ram_core.c | 4 + fs/quota/dquot.c | 38 ++- fs/sysfs/group.c | 2 +- fs/udf/misc.c | 8 +- fs/userfaultfd.c | 2 - include/dt-bindings/clock/qcom,dispcc-sc7180.h | 7 +- include/linux/acpi.h | 6 +- include/linux/cdrom.h | 1 + include/linux/dev_printk.h | 10 + include/linux/device.h | 48 ++- include/linux/dmi.h | 5 + include/linux/fsnotify_backend.h | 1 + include/linux/kvm_host.h | 3 +- include/linux/padata.h | 4 - include/linux/ppp_defs.h | 30 ++ include/linux/printk.h | 5 +- include/linux/quotaops.h | 9 +- include/linux/rtc.h | 2 + include/linux/spinlock_up.h | 20 +- include/linux/string.h | 12 + include/linux/tpm_eventlog.h | 9 +- include/linux/uprobes.h | 1 + include/linux/usb.h | 3 +- include/net/flow_dissector.h | 22 ++ include/net/ipv6.h | 6 - include/net/mac80211.h | 4 + include/net/pie.h | 2 +- include/net/red.h | 1 - include/net/route.h | 6 - include/net/udp_tunnel.h | 15 + include/sound/compress_driver.h | 2 - include/trace/events/btrfs.h | 9 +- include/trace/events/ib_mad.h | 13 +- include/trace/events/rxrpc.h | 8 + include/uapi/linux/rtc.h | 5 + include/video/udlfb.h | 1 + io_uring/io-wq.c | 3 +- io_uring/io_uring.c | 35 +- kernel/audit.c | 4 + kernel/auditsc.c | 2 +- kernel/bpf/local_storage.c | 2 +- kernel/cgroup/rdma.c | 2 +- kernel/events/uprobes.c | 10 +- kernel/padata.c | 136 ++------ kernel/taskstats.c | 1 + kernel/time/alarmtimer.c | 2 +- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_branch.c | 8 +- kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_probe.c | 2 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/ts_kmp.c | 18 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 92 +++-- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 +++- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 32 +- net/batman-adv/types.h | 6 +- net/bluetooth/bnep/core.c | 2 +- net/bluetooth/hci_event.c | 3 - net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 9 + net/bpf/test_run.c | 20 +- net/caif/cfsrvl.c | 14 +- net/can/raw.c | 11 +- net/ceph/crush/crush.c | 6 +- net/ceph/osdmap.c | 14 +- net/core/filter.c | 2 +- net/core/flow_dissector.c | 79 ++++- net/core/rtnetlink.c | 1 + net/ethtool/bitset.c | 8 +- net/ipv4/netfilter/arp_tables.c | 18 +- net/ipv4/netfilter/arpt_mangle.c | 8 + net/ipv4/nexthop.c | 36 +- net/ipv4/raw.c | 2 +- net/ipv4/route.c | 48 --- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_bpf.c | 3 + net/ipv4/udp_tunnel_core.c | 48 +++ net/ipv6/exthdrs.c | 13 +- net/ipv6/icmp.c | 10 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/ip6_output.c | 68 ---- net/ipv6/ip6_udp_tunnel.c | 69 ++++ net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/seg6_hmac.c | 2 + net/ipv6/xfrm6_protocol.c | 4 +- net/l2tp/l2tp_core.c | 5 + net/mac80211/tx.c | 4 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/ipvs/ip_vs_xmit.c | 19 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 13 +- net/netfilter/nf_conntrack_sip.c | 152 +++++++-- net/netfilter/nf_nat_amanda.c | 2 +- net/netfilter/nf_nat_sip.c | 34 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_osf.c | 45 ++- net/netfilter/nft_bitwise.c | 3 +- net/netfilter/nft_ct.c | 2 + net/netfilter/nft_fwd_netdev.c | 10 + net/netfilter/nft_osf.c | 6 +- net/netfilter/nft_set_pipapo.c | 21 +- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_mac.c | 34 +- net/netfilter/xt_multiport.c | 34 +- net/netfilter/xt_owner.c | 37 +- net/netfilter/xt_physdev.c | 29 +- net/netfilter/xt_policy.c | 2 +- net/netfilter/xt_realm.c | 2 +- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/openvswitch/datapath.c | 35 +- net/openvswitch/vport.c | 3 + net/phonet/pep.c | 19 +- net/qrtr/ns.c | 11 + net/rds/af_rds.c | 10 +- net/rds/connection.c | 14 + net/rds/ib.c | 24 +- net/rds/ib.h | 1 + net/rds/ib_rdma.c | 2 +- net/rds/message.c | 21 +- net/rds/rdma.c | 4 - net/rxrpc/call_object.c | 22 +- net/rxrpc/conn_event.c | 17 +- net/rxrpc/key.c | 12 +- net/rxrpc/proc.c | 26 +- net/rxrpc/recvmsg.c | 22 +- net/rxrpc/rxkad.c | 7 +- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/act_ct.c | 23 +- net/sched/sch_cake.c | 15 +- net/sched/sch_choke.c | 28 +- net/sched/sch_fq_codel.c | 3 +- net/sched/sch_fq_pie.c | 19 +- net/sched/sch_gred.c | 3 - net/sched/sch_hhf.c | 19 +- net/sched/sch_netem.c | 57 +++- net/sched/sch_pie.c | 52 ++- net/sched/sch_red.c | 34 +- net/sched/sch_sfb.c | 54 +-- net/sched/sch_taprio.c | 371 +++++++++++---------- net/sctp/sm_statefuns.c | 6 + net/sctp/socket.c | 11 +- net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/tipc/msg.c | 14 +- net/tls/tls_sw.c | 26 +- net/unix/diag.c | 21 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 3 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/core.c | 4 +- net/wireless/scan.c | 3 + net/xdp/xdp_umem.c | 3 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 4 + scripts/checkpatch.pl | 10 + scripts/dtc/dtc-lexer.l | 3 - security/integrity/ima/ima_crypto.c | 2 +- sound/aoa/soundbus/i2sbus/core.c | 9 +- sound/core/compress_offload.c | 75 ----- sound/core/control.c | 4 + sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/sound.c | 7 + sound/firewire/fireworks/fireworks_command.c | 5 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/pci/asihpi/hpicmn.c | 6 + sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/codecs/ab8500-codec.c | 6 +- sound/soc/fsl/fsl_easrc.c | 125 +++++-- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/sti/uniperif_player.c | 9 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 39 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/clock.c | 6 + sound/usb/format.c | 2 +- sound/usb/midi.c | 12 +- sound/usb/misc/ua101.c | 12 +- sound/usb/mixer.c | 14 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/stream.c | 4 +- tools/perf/util/branch.h | 3 + tools/perf/util/expr.c | 3 +- tools/perf/util/util.h | 1 - tools/testing/ktest/ktest.pl | 35 +- tools/testing/selftests/cgroup/test_memcontrol.c | 11 +- tools/testing/selftests/lib.mk | 1 + .../testing/selftests/mqueue/{setting => settings} | 0 514 files changed, 4832 insertions(+), 2163 deletions(-)

4 months

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage June 2026