Lkft-triage July 2026

lkft-triage@lists.linaro.org

29 participants
24 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.4 release. There are 533 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 19 Jul 2026 10:18:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.4-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.4-rc2 Darrick J. Wong <djwong(a)kernel.org> xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging Darrick J. Wong <djwong(a)kernel.org> xfs: write the rg superblock when fixing it Darrick J. Wong <djwong(a)kernel.org> xfs: fix off-by-one error when calling xchk_xref_has_rt_owner Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap bmbt forks if they are MAXLEVELS tall Darrick J. Wong <djwong(a)kernel.org> xfs: fully check the parent handle when it points to the rootdir Darrick J. Wong <djwong(a)kernel.org> xfs: clamp timestamp nanoseconds correctly Darrick J. Wong <djwong(a)kernel.org> xfs: handle non-inode owners for rtrmap record checking Darrick J. Wong <djwong(a)kernel.org> xfs: set xfarray killable sort correctly Darrick J. Wong <djwong(a)kernel.org> xfs: use the rt version of the cow staging checker Darrick J. Wong <djwong(a)kernel.org> xfs: grab rtrmap btree when checking rgsuper Darrick J. Wong <djwong(a)kernel.org> xfs: don't wrap around quota ids in dqiterate Darrick J. Wong <djwong(a)kernel.org> xfs: resample the data fork mapping after cycling ILOCK Weiming Shi <bestswngs(a)gmail.com> xfs: fail recovery on a committed log item with no regions Andrey Albershteyn <aalbersh(a)kernel.org> xfs: fix null pointer dereference in tracepoint Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: reject overlapping data areas in SMB2 responses Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> timekeeping: Register default clocksource before taking tk_core.lock Rong Zhang <i(a)rong.moe> ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid queue->stopped races and set/read that value under lock Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues Chris Mason <clm(a)meta.com> fuse-uring: end fuse_req on io-uring cancel task work Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix moving cancelled entry to ent_in_userspace list Chris Mason <clm(a)meta.com> fuse-uring: fix data races on ring->ready Chris Mason <clm(a)meta.com> fuse-uring: fix EFAULT clobber in fuse_uring_commit Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: don't block in fuse_get_dev() for non-sync_init case Joanne Koong <joannelkoong(a)gmail.com> fuse: fix io-uring background queue dispatch on request completion Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Miklos Szeredi <mszeredi(a)redhat.com> fuse: do not use start_removing_noperm() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Miklos Szeredi <mszeredi(a)redhat.com> Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()" Samuel Moelius <sam.moelius(a)trailofbits.com> fuse: avoid 32-bit prune notification count wrap Matthew R. Ochs <mochs(a)nvidia.com> fuse: back uncached readdir buffers with pages Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Maher Sanalla <msanalla(a)nvidia.com> RDMA/core: Fix broadcast address falsely detected as local Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Xu Rao <raoxu(a)uniontech.com> Input: gscps2 - advance receive buffer write index Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Kris Bahnsen <kris(a)embeddedTS.com> Input: ads7846 - don't use scratch for tx_buf when clearing register Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: mark I2C adapter when hardware is powered down Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Chuck Lever <chuck.lever(a)oracle.com> Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers" Chuck Lever <chuck.lever(a)oracle.com> svcrdma: wake sq waiters when the transport closes Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Oliver Upton <oupton(a)kernel.org> KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier Sean Christopherson <seanjc(a)google.com> KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs Sean Christopherson <seanjc(a)google.com> KVM: guest_memfd: Treat memslot binding offset+size as unsigned values Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Sean Christopherson <seanjc(a)google.com> KVM: TDX: Account all non-transient page allocations for per-TD structures Xuanqing Shi <1356292400(a)qq.com> KVM: VMX: Handle bad values on proxied writes to LBR MSRs Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Sean Christopherson <seanjc(a)google.com> KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated Sean Christopherson <seanjc(a)google.com> KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports Sean Christopherson <seanjc(a)google.com> KVM: SEV: Pin source page for write when adding CPUID data for SNP guest Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Add missing slots_lock for device register/unregister Marc Zyngier <maz(a)kernel.org> KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Increase default audit socket timeout Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Filter dealloc records in audit_count_records() Mickaël Salaün <mic(a)digikod.net> landlock: Account all audit data allocations to user space Maximilian Heyne <mheyne(a)amazon.de> selftests/landlock: Explicitly disable audit in teardowns Mickaël Salaün <mic(a)digikod.net> landlock: Set audit_net.sk for socket access checks Ricardo Robaina <rrobaina(a)redhat.com> audit: fix removal of dangling executable rules Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Break the loop on failure in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_veventq_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set veventq_depth upper bound Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Move vevent memory allocation outside spinlock Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Fix data_len byte-count vs element-count mismatch Kai Aizen <kai.aizen.dev(a)gmail.com> iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Avoid WARNING in sva unbind path Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Dave Airlie <airlied(a)redhat.com> nouveau/vmm: fix another SPT/LPT race Sarthak Sharma <sarthak.sharma(a)arm.com> selftests/mm: fix ksft_process_madv.sh test category Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Ketan <ketan.kishore(a)oss.qualcomm.com> mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Hao Ge <hao.ge(a)linux.dev> lib/test_hmm: use kvfree() to free kvcalloc() allocations Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Define DIRECT_MAP_PHYSMEM_END Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Rochan Avlur <rochan.avlur(a)gmail.com> exfat: preserve benign secondary entries during rename and move Nicolas Pitre <npitre(a)baylibre.com> vt: fix spurious modifier in CSI/cursor key sequences Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Gabriele Monaco <gmonaco(a)redhat.com> rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Luca Boccassi <luca.boccassi(a)gmail.com> selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION calls with invalid length Luca Boccassi <luca.boccassi(a)gmail.com> liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length Lee Jia Jie <jiajie.lee(a)starlabs.sg> perf/aux: Fix page UAF in map_range() Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing David Hildenbrand (Arm) <david(a)kernel.org> x86/mm: Fix freeing of PMD-sized vmemmap pages Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - factor out AER reset helpers Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - skip restart for down devices Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - handle sysfs-triggered reset callbacks Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - fix restarting state leak on allocation failure Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - centralize bus master enable Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix ineffective sanity check Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Remove broken and unused loongson-rng Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Select CRYPTO_RNG Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Eric Biggers <ebiggers(a)kernel.org> crypto: hisi-trng - Remove crypto_rng interface Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Eric Biggers <ebiggers(a)kernel.org> crypto: crypto4xx - Remove insecure and unused rng_alg Xiaonan Zhao <ngochuongbui67(a)gmail.com> crypto: chacha20poly1305 - validate poly1305 template argument Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Qu Wenruo <wqu(a)suse.com> btrfs: fix incorrect buffered IO fallback for append direct writes Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Qu Wenruo <wqu(a)suse.com> btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Qu Wenruo <wqu(a)suse.com> btrfs: fix false IO failure after falling back to buffered write Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> block: partitions: fix of_node refcount leak in of_partition() Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - fail on hwrng registration error in probe path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Arjan van de Ven <arjan(a)linux.intel.com> wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Tyler Baker <tyler.baker(a)oss.qualcomm.com> usb: gadget: f_fs: initialize reset_work at allocation time Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Stephan Gerhold <stephan.gerhold(a)linaro.org> usb: typec: ps883x: Fix DP+USB3 configuration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure HE WEI (ギカク) <skyexpoc(a)gmail.com> usb: misc: usbio: bound bulk IN response length to the received transfer Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Ben Dooks <ben.dooks(a)codethink.co.uk> usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Jens Glathe <jens.glathe(a)oldschoolsolutions.biz> Revert "usb: typec: mux: avoid duplicated mux switches" Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Vlad Poenaru <vlad.wing(a)gmail.com> bpf: Allow LPM map access from sleepable BPF programs Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> bpf: Keep dynamic inner array lookups nullable Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Dawei Feng <dawei.feng(a)seu.edu.cn> xfs: fix memory leak in xfs_dqinode_metadir_create() Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Christoph Hellwig <hch(a)lst.de> xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap Christoph Hellwig <hch(a)lst.de> xfs: only log freed extents for the current RTG in zoned growfs Christoph Hellwig <hch(a)lst.de> xfs: pass back updated nb from xfs_growfs_compute_deltas Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: appleir: fix UAF on pending key_up_timer in remove() Trung Nguyen <trungnh(a)cystack.net> HID: multitouch: fix out-of-bounds bit access on mt_io_flags Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert Manish Khadka <maskmemanish(a)gmail.com> HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() Oleg Makarenko <oleg(a)makarenk.ooo> HID: pidff: Use correct effect type in effect update Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Heiko Carstens <hca(a)linux.ibm.com> s390: Revert support for DCACHE_WORD_ACCESS Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Jann Horn <jannh(a)google.com> proc: protect ptrace_may_access() with exec_update_lock (part 1) Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() Jann Horn <jannh(a)google.com> proc: protect ptrace_may_access() with exec_update_lock (FD links) John Hubbard <jhubbard(a)nvidia.com> libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: do not require delete access for non-replacing links Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Ralph Boehme <slow(a)samba.org> smb/client: fix chown/chgrp with SMB3 POSIX Extensions Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate NTLMv2 response before updating session key Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: track the connection owning a byte-range lock Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: prevent path traversal bypass by restricting caseless retry Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: resolve SWN tcon from live registrations Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Runyu Xiao <runyu.xiao(a)seu.edu.cn> Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: IPIP tunnel hardware offload is not yet support Adrian Bente <adibente(a)gmail.com> netfilter: flowtable: fix offloaded ct timeout never being extended Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: ebtables: zero chainstack array Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host Qi Zheng <qi.zheng(a)linux.dev> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <qi.zheng(a)linux.dev> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix use-after-free on remove Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Michael Wigham <michael(a)wigham.net> io_uring/rw: preserve partial result for iopoll Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Vasileios Almpanis <vasilisalmpanis(a)gmail.com> io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: sch: use raw_spinlock_t in the irq startup path Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Valeriy Yashnikov <yashnikov.valeriy(a)gmail.com> ntfs: avoid calling post_write_mst_fixup() for invalid index_block Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Michael Bommarito <michael.bommarito(a)gmail.com> crypto: krb5 - filter out async aead implementations at alloc Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Christopher Mackle <christophermackle01(a)gmail.com> staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: media: ipu7: fix double-free and use-after-free in error paths Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yuanhe Shu <xiangzao(a)linux.alibaba.com> tracing: Fix NULL pointer dereference in func_set_flag() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Cen Zhang <zzzccc427(a)gmail.com> usb: misc: usbio: fix disconnect UAF in client teardown Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Michael Bommarito <michael.bommarito(a)gmail.com> tcp: restore RCU grace period in tcp_ao_destroy_sock Marco Nenciarini <mnencia(a)kcore.it> PCI/IOV: Skip VF Resizable BAR restore on read error Marco Nenciarini <mnencia(a)kcore.it> PCI: Skip Resizable BAR restore on read error Yadu M G <yadu.mg(a)oss.qualcomm.com> PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: mediatek: Fix IRQ domain leak when port fails to enable Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95 Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95 Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Fix resource leaks on probe failure Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Han Gao <gaohan(a)iscas.ac.cn> riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Xu Rao <raoxu(a)uniontech.com> xhci: sideband: fix ring sg table pages leak 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Alice Ryhl <aliceryhl(a)google.com> rust_binder: clear freeze listener on node removal Keshav Verma <iganschel(a)gmail.com> rust_binder: synchronize Rust Binder stats with freeze commands Keshav Verma <iganschel(a)gmail.com> rust_binder: reject context manager self-transaction Alice Ryhl <aliceryhl(a)google.com> rust_binder: fix BINDER_GET_EXTENDED_ERROR Hyunwoo Kim <imv4bel(a)gmail.com> rust_binder: use a u64 stride when cleaning up the offsets array Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio/mlx5: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match Gordon Chen <chengordon326(a)gmail.com> ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 WenTao Liang <vulab(a)iscas.ac.cn> ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW Huacai Chen <chenhuacai(a)kernel.org> ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson Cameron Graham <cam.graham(a)gmail.com> ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda/cs35l41: Fix firmware load work teardown Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Add Focusrite ISA C8X support Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: compress: Fix task creation error unwind Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: aoa: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping HyeongJun An <sammiee5311(a)gmail.com> ALSA: usx2y: us144mkii: fix work UAF on disconnect Stepan Ionichev <sozdayvek(a)gmail.com> iio: temperature: tmp006: use devm_iio_trigger_register Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Stepan Ionichev <sozdayvek(a)gmail.com> iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths Biren Pandya <birenpandya(a)gmail.com> iio: pressure: mpl115: fix runtime PM leak on read error David Carlier <devnexen(a)gmail.com> iio: pressure: bmp280: zero-init bmp580 trigger handler buffer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3320a: read both ALS ADC registers again Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3320a: add missing REGMAP_I2C to Kconfig Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3010: read both ALS ADC registers again Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3010: add missing REGMAP_I2C to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3000a: add missing REGMAP_I2C to Kconfig Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Dan Carpenter <error27(a)gmail.com> iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() Dan Carpenter <error27(a)gmail.com> iio: core: fix uninitialized data in debugfs Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: free scan_mask on buffer release Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix CS held asserted and state leaks Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig Jonathan Cameron <jic23(a)kernel.org> iio: adc: ad7768-1: Select GPIOLIB Samuel Moelius <samuel.moelius(a)trailofbits.com> iio: adc: ad7380: select REGMAP Arnd Bergmann <arnd(a)arndb.de> iio: adc: ad4062: add GPIOLIB dependency Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Po-Hao Huang <phhuang(a)realtek.com> wifi: rtw89: correct drop logic for malformed AMPDU frames Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer dirty packs for eBPF allocations Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer packs that won't trigger an IBPB flush on allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Skip redundant IBPB in pack allocator Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Restrict JIT predictor flush to cBPF Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Enable IBPB flush on BPF JIT allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Support for hardening against JIT spraying Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Gary Guo <gary(a)garyguo.net> rust: doctest: fix incorrect pattern in replacement Haoze Xie <royenheart(a)gmail.com> rust: block: fix GenDisk cleanup paths Danilo Krummrich <dakr(a)kernel.org> rust: pci: use 'static lifetime for PCI BAR resource names Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Miguel Ojeda <ojeda(a)kernel.org> rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Carlos López <clopez(a)suse.de> KVM: x86: Unconditionally recompute CR8 intercept on PPR update Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Move update_cr8_intercept() to lapic.c Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Randy Dunlap <rdunlap(a)infradead.org> slab: recognize @GFP parameter as optional in kernel-doc Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing Xingquan Liu <b1n(a)b1n.io> net/sched: dualpi2: fix GSO backlog accounting Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Miguel Ojeda <ojeda(a)kernel.org> rust: str: clean unused import for Rust >= 1.98 Miguel Ojeda <ojeda(a)kernel.org> rust: str: use the "kernel vertical" imports style ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Documentation/sound/alsa-configuration.rst | 6 + MAINTAINERS | 1 - Makefile | 7 +- arch/arm64/include/asm/kvm_hyp.h | 1 + arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/kvm/arm.c | 2 + arch/arm64/kvm/hyp/nvhe/hyp-main.c | 12 + arch/arm64/kvm/nested.c | 40 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/configs/loongson32_defconfig | 1 - arch/loongarch/configs/loongson64_defconfig | 1 - arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/kvm/intc/eiointc.c | 6 + arch/loongarch/kvm/intc/ipi.c | 2 + arch/loongarch/kvm/intc/pch_pic.c | 2 + arch/loongarch/net/bpf_jit.c | 5 +- arch/loongarch/pci/acpi.c | 2 + arch/powerpc/net/bpf_jit_comp.c | 4 +- arch/riscv/boot/dts/sophgo/sg2042.dtsi | 4 + arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/riscv/net/bpf_jit_comp64.c | 2 +- arch/riscv/net/bpf_jit_core.c | 3 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/asm-extable.h | 4 - arch/s390/include/asm/word-at-a-time.h | 22 - arch/s390/mm/extable.c | 18 - arch/x86/events/intel/uncore_snb.c | 7 - arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kernel/cpu/resctrl/monitor.c | 5 + arch/x86/kvm/lapic.c | 49 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 47 +- arch/x86/kvm/svm/sev.c | 10 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/pmu_intel.c | 6 +- arch/x86/kvm/vmx/tdx.c | 16 +- arch/x86/kvm/vmx/vmx.c | 44 +- arch/x86/kvm/x86.c | 38 +- arch/x86/mm/init_64.c | 40 +- arch/x86/net/bpf_jit_comp.c | 5 +- block/bdev.c | 8 +- block/partitions/aix.c | 9 + block/partitions/of.c | 5 +- crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/chacha20poly1305.c | 11 +- crypto/df_sp80090a.c | 7 +- crypto/drbg.c | 16 +- crypto/ecc.c | 31 +- crypto/krb5/krb5_api.c | 2 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 21 +- drivers/android/binder.c | 19 +- drivers/android/binder/allocation.rs | 5 +- drivers/android/binder/error.rs | 13 +- drivers/android/binder/freeze.rs | 11 +- drivers/android/binder/node.rs | 10 +- drivers/android/binder/process.rs | 18 +- drivers/android/binder/rust_binder_events.c | 7 +- drivers/android/binder/stats.rs | 4 +- drivers/android/binder/thread.rs | 65 ++- drivers/android/binder/transaction.rs | 15 +- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/Kconfig | 2 - drivers/crypto/Makefile | 1 - drivers/crypto/amcc/crypto4xx_core.c | 88 ---- drivers/crypto/amcc/crypto4xx_core.h | 4 - drivers/crypto/amcc/crypto4xx_reg_def.h | 11 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/atmel-sha204a.c | 27 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 70 +-- drivers/crypto/hisilicon/Kconfig | 1 - drivers/crypto/hisilicon/trng/trng.c | 296 +---------- drivers/crypto/intel/qat/qat_420xx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c3xxxvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62x/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62xvf/adf_drv.c | 1 - .../intel/qat/qat_common/adf_accel_devices.h | 2 + drivers/crypto/intel/qat/qat_common/adf_aer.c | 109 ++-- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 + drivers/crypto/intel/qat/qat_common/adf_init.c | 18 + drivers/crypto/intel/qat/qat_common/adf_isr.c | 39 ++ drivers/crypto/intel/qat/qat_common/adf_sriov.c | 32 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_dh895xccvf/adf_drv.c | 1 - drivers/crypto/loongson/Kconfig | 5 - drivers/crypto/loongson/Makefile | 1 - drivers/crypto/loongson/loongson-rng.c | 209 -------- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-sch.c | 32 +- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c | 31 +- drivers/hid/hid-appleir.c | 45 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-lenovo-go.c | 9 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-logitech-dj.c | 9 +- drivers/hid/hid-multitouch.c | 32 +- drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 2 +- drivers/hid/wacom_sys.c | 20 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/Kconfig | 4 + drivers/iio/adc/ad_sigma_delta.c | 39 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/nxp-sar-adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/buffer/industrialio-hw-consumer.c | 2 + drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/Kconfig | 3 + drivers/iio/light/al3010.c | 10 +- drivers/iio/light/al3320a.c | 8 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/mpl115.c | 4 +- drivers/iio/proximity/vl53l0x-i2c.c | 7 +- drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/iio/temperature/tmp006.c | 2 +- drivers/infiniband/core/addr.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/serio/gscps2.c | 1 + drivers/input/touchscreen/ads7846.c | 5 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/intel/iommu.h | 11 + drivers/iommu/intel/svm.c | 12 +- drivers/iommu/iommufd/driver.c | 13 +- drivers/iommu/iommufd/eventq.c | 36 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/iommu/iommufd/iommufd_private.h | 2 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/usb/kalmia.c | 8 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtw89/core.c | 3 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 65 ++- drivers/pci/controller/dwc/pcie-qcom.c | 6 + drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 36 +- drivers/pci/controller/pcie-mediatek.c | 65 ++- drivers/pci/iov.c | 6 + drivers/pci/quirks.c | 51 +- drivers/pci/rebar.c | 6 + drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/media/ipu7/ipu7.c | 22 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/rtl8723bs/os_dep/xmit_linux.c | 6 +- drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/tty/vt/keyboard.c | 12 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/core.c | 4 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 9 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci-sideband.c | 2 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 61 +-- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/usbio.c | 8 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/mux.c | 13 +- drivers/usb/typec/mux/ps883x.c | 6 +- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/mlx5/cmd.h | 15 +- drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/btrfs/btrfs_inode.h | 2 + fs/btrfs/direct-io.c | 60 ++- fs/btrfs/extent-tree.c | 12 +- fs/btrfs/file.c | 25 +- fs/btrfs/inode.c | 67 ++- fs/btrfs/ordered-data.c | 12 + fs/btrfs/ordered-data.h | 2 + fs/btrfs/reflink.c | 4 +- fs/exfat/dir.c | 63 ++- fs/exfat/exfat_fs.h | 5 +- fs/exfat/namei.c | 89 +++- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 66 ++- fs/fuse/dev_uring.c | 93 ++-- fs/fuse/dev_uring_i.h | 10 +- fs/fuse/dir.c | 36 +- fs/fuse/fuse_dev_i.h | 1 + fs/fuse/notify.c | 434 ++++++++++++++++ fs/fuse/readdir.c | 85 +++- fs/hfs/bnode.c | 4 +- fs/hfsplus/bnode.c | 2 + fs/hfsplus/hfsplus_fs.h | 2 +- fs/isofs/rock.c | 11 + fs/libfs.c | 1 + fs/nfs/dir.c | 2 + fs/nilfs2/segment.c | 22 + fs/ntfs/index.c | 5 +- fs/ntfs3/fslog.c | 20 +- fs/proc/array.c | 6 + fs/proc/base.c | 162 +++--- fs/proc/fd.c | 25 +- fs/proc/internal.h | 2 +- fs/proc/namespaces.c | 12 + fs/resctrl/monitor.c | 37 +- fs/smb/client/cifs_swn.c | 316 ++++++++++-- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/inode.c | 3 +- fs/smb/client/smb2misc.c | 52 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/client/trace.h | 2 + fs/smb/server/auth.c | 20 +- fs/smb/server/smb2pdu.c | 117 +++-- fs/smb/server/vfs.c | 20 +- fs/smb/server/vfs_cache.c | 28 +- fs/smb/server/vfs_cache.h | 3 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 20 + fs/xfs/libxfs/xfs_ag.c | 10 +- fs/xfs/libxfs/xfs_ag.h | 2 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_defer.c | 2 +- fs/xfs/libxfs/xfs_dquot_buf.c | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/scrub/dirtree.c | 16 +- fs/xfs/scrub/dqiterate.c | 2 +- fs/xfs/scrub/inode_repair.c | 4 +- fs/xfs/scrub/rgsuper.c | 14 +- fs/xfs/scrub/rtbitmap.c | 2 +- fs/xfs/scrub/rtrefcount.c | 2 +- fs/xfs/scrub/rtrmap.c | 8 +- fs/xfs/scrub/scrub.h | 6 +- fs/xfs/scrub/xfarray.c | 3 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_fsops.c | 2 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log_recover.c | 15 +- fs/xfs/xfs_qm.c | 5 +- fs/xfs/xfs_reflink.c | 36 ++ fs/xfs/xfs_rtalloc.c | 8 +- include/asm-generic/rqspinlock.h | 14 +- include/crypto/drbg.h | 18 +- include/crypto/internal/drbg.h | 18 - include/linux/bpf_lsm.h | 4 + include/linux/damon.h | 8 +- include/linux/filter.h | 15 +- include/linux/fs.h | 5 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/kvm_host.h | 3 +- include/linux/page_ext.h | 19 +- include/linux/slab.h | 6 +- include/linux/sunrpc/svc_rdma.h | 1 + include/linux/vfio_pci_core.h | 15 +- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/netfilter/nf_flow_table.h | 2 + include/net/tcp_ao.h | 1 + include/sound/hda_codec.h | 1 + init/Kconfig | 1 + io_uring/io-wq.c | 2 +- io_uring/nop.c | 8 +- io_uring/rw.c | 12 +- kernel/audit.c | 21 +- kernel/audit_fsnotify.c | 4 - kernel/bpf/bpf_inode_storage.c | 9 + kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/core.c | 68 ++- kernel/bpf/devmap.c | 7 + kernel/bpf/dispatcher.c | 2 +- kernel/bpf/lpm_trie.c | 8 +- kernel/bpf/verifier.c | 15 +- kernel/events/core.c | 19 +- kernel/futex/requeue.c | 6 - kernel/liveupdate/luo_session.c | 4 + kernel/module/decompress.c | 2 + kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/time/timekeeping.c | 7 +- kernel/trace/trace_events_filter.c | 6 +- kernel/trace/trace_functions.c | 8 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- lib/test_hmm.c | 4 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swap_cgroup.c | 2 + mm/swapfile.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/hci_conn.c | 21 +- net/bluetooth/hci_sync.c | 137 ++++- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 80 +-- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 12 +- net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_ao.c | 5 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_flow_table_core.c | 20 +- net/netfilter/nf_flow_table_offload.c | 22 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/sched/sch_dualpi2.c | 11 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 4 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 229 +-------- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 6 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 30 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- rust/kernel/block/mq/gen_disk.rs | 20 +- rust/kernel/cpufreq.rs | 2 +- rust/kernel/pci/io.rs | 6 +- rust/kernel/str.rs | 23 +- scripts/rustdoc_test_builder.rs | 16 +- security/bpf/hooks.c | 3 + security/landlock/domain.c | 9 +- security/landlock/domain.h | 5 +- security/landlock/net.c | 1 + sound/aoa/fabrics/layout.c | 6 + sound/core/compress_offload.c | 13 +- sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/hda/codecs/hdmi/hdmi.c | 9 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 77 ++- sound/hda/codecs/side-codecs/cs35l41_hda.h | 5 + sound/hda/common/jack.c | 6 + sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 10 +- sound/usb/mixer_quirks.c | 102 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/usb/quirks.c | 3 + sound/usb/usbaudio.h | 8 + sound/usb/usx2y/us144mkii.c | 17 +- sound/usb/usx2y/us144mkii_capture.c | 2 +- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/landlock/audit.h | 140 +++-- tools/testing/selftests/landlock/audit_test.c | 6 +- tools/testing/selftests/landlock/net_test.c | 62 +++ tools/testing/selftests/landlock/ptrace_test.c | 1 + .../selftests/landlock/scoped_abstract_unix_test.c | 1 + tools/testing/selftests/liveupdate/liveupdate.c | 42 ++ tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/ksft_process_madv.sh | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + virt/kvm/guest_memfd.c | 14 +- virt/kvm/kvm_mm.h | 7 +- 512 files changed, 5927 insertions(+), 3401 deletions(-)

2 days, 15 hours

[PATCH 6.18 000/495] 6.18.39-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.39 release. There are 495 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 19 Jul 2026 10:18:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.39-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.39-rc2 Darrick J. Wong <djwong(a)kernel.org> xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging Darrick J. Wong <djwong(a)kernel.org> xfs: write the rg superblock when fixing it Darrick J. Wong <djwong(a)kernel.org> xfs: fix off-by-one error when calling xchk_xref_has_rt_owner Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap bmbt forks if they are MAXLEVELS tall Darrick J. Wong <djwong(a)kernel.org> xfs: fully check the parent handle when it points to the rootdir Darrick J. Wong <djwong(a)kernel.org> xfs: clamp timestamp nanoseconds correctly Darrick J. Wong <djwong(a)kernel.org> xfs: handle non-inode owners for rtrmap record checking Darrick J. Wong <djwong(a)kernel.org> xfs: set xfarray killable sort correctly Darrick J. Wong <djwong(a)kernel.org> xfs: use the rt version of the cow staging checker Darrick J. Wong <djwong(a)kernel.org> xfs: grab rtrmap btree when checking rgsuper Darrick J. Wong <djwong(a)kernel.org> xfs: don't wrap around quota ids in dqiterate Darrick J. Wong <djwong(a)kernel.org> xfs: resample the data fork mapping after cycling ILOCK Weiming Shi <bestswngs(a)gmail.com> xfs: fail recovery on a committed log item with no regions Andrey Albershteyn <aalbersh(a)kernel.org> xfs: fix null pointer dereference in tracepoint Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: reject overlapping data areas in SMB2 responses Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> timekeeping: Register default clocksource before taking tk_core.lock Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Adam Li <adamli(a)os.amperecomputing.com> sched/fair: Only update stats for allowed CPUs when looking for dst group Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid queue->stopped races and set/read that value under lock Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues Chris Mason <clm(a)meta.com> fuse-uring: end fuse_req on io-uring cancel task work Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix moving cancelled entry to ent_in_userspace list Chris Mason <clm(a)meta.com> fuse-uring: fix data races on ring->ready Chris Mason <clm(a)meta.com> fuse-uring: fix EFAULT clobber in fuse_uring_commit Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: fix io-uring background queue dispatch on request completion Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Samuel Moelius <sam.moelius(a)trailofbits.com> fuse: avoid 32-bit prune notification count wrap Matthew R. Ochs <mochs(a)nvidia.com> fuse: back uncached readdir buffers with pages Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Maher Sanalla <msanalla(a)nvidia.com> RDMA/core: Fix broadcast address falsely detected as local Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Xu Rao <raoxu(a)uniontech.com> Input: gscps2 - advance receive buffer write index Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Kris Bahnsen <kris(a)embeddedTS.com> Input: ads7846 - don't use scratch for tx_buf when clearing register Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: mark I2C adapter when hardware is powered down Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Oliver Upton <oupton(a)kernel.org> KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier Sean Christopherson <seanjc(a)google.com> KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Xuanqing Shi <1356292400(a)qq.com> KVM: VMX: Handle bad values on proxied writes to LBR MSRs Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Sean Christopherson <seanjc(a)google.com> KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated Sean Christopherson <seanjc(a)google.com> KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Add missing slots_lock for device register/unregister Marc Zyngier <maz(a)kernel.org> KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Filter dealloc records in audit_count_records() Mickaël Salaün <mic(a)digikod.net> landlock: Set audit_net.sk for socket access checks Ricardo Robaina <rrobaina(a)redhat.com> audit: fix removal of dangling executable rules Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Break the loop on failure in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_veventq_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set veventq_depth upper bound Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Fix data_len byte-count vs element-count mismatch Kai Aizen <kai.aizen.dev(a)gmail.com> iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Avoid WARNING in sva unbind path Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Remove broken and unused loongson-rng Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Ketan <ketan.kishore(a)oss.qualcomm.com> mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Define DIRECT_MAP_PHYSMEM_END Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Gabriele Monaco <gmonaco(a)redhat.com> rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Lee Jia Jie <jiajie.lee(a)starlabs.sg> perf/aux: Fix page UAF in map_range() Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing David Hildenbrand (Arm) <david(a)kernel.org> x86/mm: Fix freeing of PMD-sized vmemmap pages Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - factor out AER reset helpers Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - skip restart for down devices Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - handle sysfs-triggered reset callbacks Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - centralize bus master enable Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Select CRYPTO_RNG Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Eric Biggers <ebiggers(a)kernel.org> crypto: hisi-trng - Remove crypto_rng interface Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Eric Biggers <ebiggers(a)kernel.org> crypto: crypto4xx - Remove insecure and unused rng_alg Xiaonan Zhao <ngochuongbui67(a)gmail.com> crypto: chacha20poly1305 - validate poly1305 template argument Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Qu Wenruo <wqu(a)suse.com> btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> block: partitions: fix of_node refcount leak in of_partition() Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer dirty packs for eBPF allocations Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer packs that won't trigger an IBPB flush on allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Skip redundant IBPB in pack allocator Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Restrict JIT predictor flush to cBPF Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Enable IBPB flush on BPF JIT allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Support for hardening against JIT spraying Alice Ryhl <aliceryhl(a)google.com> rust_binder: fix BINDER_GET_EXTENDED_ERROR Alice Ryhl <aliceryhl(a)google.com> rust_binder: introduce TransactionInfo Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: shmem: fix potential livelock issue for shmem direct swapin Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure HE WEI (ギカク) <skyexpoc(a)gmail.com> usb: misc: usbio: bound bulk IN response length to the received transfer Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Dawei Feng <dawei.feng(a)seu.edu.cn> xfs: fix memory leak in xfs_dqinode_metadir_create() Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: appleir: fix UAF on pending key_up_timer in remove() Trung Nguyen <trungnh(a)cystack.net> HID: multitouch: fix out-of-bounds bit access on mt_io_flags Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert Oleg Makarenko <oleg(a)makarenk.ooo> HID: pidff: Use correct effect type in effect update Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Heiko Carstens <hca(a)linux.ibm.com> s390: Revert support for DCACHE_WORD_ACCESS Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() John Hubbard <jhubbard(a)nvidia.com> libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: resolve SWN tcon from live registrations Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Deepanshu Kartikey <kartikey406(a)gmail.com> fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fsync files by syncing parent inodes Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Fix race condition during PASID entry replacement Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Runyu Xiao <runyu.xiao(a)seu.edu.cn> Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Adrian Bente <adibente(a)gmail.com> netfilter: flowtable: fix offloaded ct timeout never being extended Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: ebtables: zero chainstack array Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Michael Wigham <michael(a)wigham.net> io_uring/rw: preserve partial result for iopoll Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Vasileios Almpanis <vasilisalmpanis(a)gmail.com> io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: sch: use raw_spinlock_t in the irq startup path Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Michael Bommarito <michael.bommarito(a)gmail.com> crypto: krb5 - filter out async aead implementations at alloc Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: media: ipu7: fix double-free and use-after-free in error paths Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Cen Zhang <zzzccc427(a)gmail.com> usb: misc: usbio: fix disconnect UAF in client teardown Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Michael Bommarito <michael.bommarito(a)gmail.com> tcp: restore RCU grace period in tcp_ao_destroy_sock Marco Nenciarini <mnencia(a)kcore.it> PCI/IOV: Skip VF Resizable BAR restore on read error Yadu M G <yadu.mg(a)oss.qualcomm.com> PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: mediatek: Fix IRQ domain leak when port fails to enable Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Fix resource leaks on probe failure Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Xu Rao <raoxu(a)uniontech.com> xhci: sideband: fix ring sg table pages leak 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Alice Ryhl <aliceryhl(a)google.com> rust_binder: clear freeze listener on node removal Keshav Verma <iganschel(a)gmail.com> rust_binder: synchronize Rust Binder stats with freeze commands Keshav Verma <iganschel(a)gmail.com> rust_binder: reject context manager self-transaction Hyunwoo Kim <imv4bel(a)gmail.com> rust_binder: use a u64 stride when cleaning up the offsets array Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match WenTao Liang <vulab(a)iscas.ac.cn> ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW Huacai Chen <chenhuacai(a)kernel.org> ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson Cameron Graham <cam.graham(a)gmail.com> ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda/cs35l41: Fix firmware load work teardown Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Add Focusrite ISA C8X support Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: compress: Fix task creation error unwind Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: aoa: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping HyeongJun An <sammiee5311(a)gmail.com> ALSA: usx2y: us144mkii: fix work UAF on disconnect Stepan Ionichev <sozdayvek(a)gmail.com> iio: temperature: tmp006: use devm_iio_trigger_register Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Stepan Ionichev <sozdayvek(a)gmail.com> iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths Biren Pandya <birenpandya(a)gmail.com> iio: pressure: mpl115: fix runtime PM leak on read error David Carlier <devnexen(a)gmail.com> iio: pressure: bmp280: zero-init bmp580 trigger handler buffer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3320a: read both ALS ADC registers again Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3320a: add missing REGMAP_I2C to Kconfig Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3010: read both ALS ADC registers again Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3010: add missing REGMAP_I2C to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3000a: add missing REGMAP_I2C to Kconfig Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Dan Carpenter <error27(a)gmail.com> iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() Dan Carpenter <error27(a)gmail.com> iio: core: fix uninitialized data in debugfs Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix CS held asserted and state leaks Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: adc: ad7768-1: Select GPIOLIB Samuel Moelius <samuel.moelius(a)trailofbits.com> iio: adc: ad7380: select REGMAP Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Gary Guo <gary(a)garyguo.net> rust: doctest: fix incorrect pattern in replacement Haoze Xie <royenheart(a)gmail.com> rust: block: fix GenDisk cleanup paths Miguel Ojeda <ojeda(a)kernel.org> rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Carlos López <clopez(a)suse.de> KVM: x86: Unconditionally recompute CR8 intercept on PPR update Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Move update_cr8_intercept() to lapic.c Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Randy Dunlap <rdunlap(a)infradead.org> slab: recognize @GFP parameter as optional in kernel-doc Linus Torvalds <torvalds(a)linux-foundation.org> default_gfp(): avoid using the "newfangled" __VA_OPT__ trick Linus Torvalds <torvalds(a)linux-foundation.org> add default_gfp() helper macro and use it in the new *alloc_obj() helpers Kees Cook <kees(a)kernel.org> slab: Introduce kmalloc_flex() and family Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing NeilBrown <neil(a)brown.name> nfsd: change nfs4_client_to_reclaim() to allocate data NeilBrown <neilb(a)ownmail.net> nfsd: move name lookup out of nfsd4_list_rec_dir() Xingquan Liu <b1n(a)b1n.io> net/sched: dualpi2: fix GSO backlog accounting Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Chao Yu <chao(a)kernel.org> f2fs: detect more inconsistent cases in sanity_check_node_footer() YH Lin <yhli(a)google.com> f2fs: optimize trace_f2fs_write_checkpoint with enums Chao Yu <chao(a)kernel.org> f2fs: introduce f2fs_schedule_timeout() Chao Yu <chao(a)kernel.org> f2fs: use memalloc_retry_wait() as much as possible Keshav Verma <iganschel(a)gmail.com> f2fs: fix listxattr handling of corrupted xattr entries Chao Yu <chao(a)kernel.org> f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Ruipeng Qi <ruipengqi3(a)gmail.com> f2fs: fix potential deadlock in f2fs_balance_fs() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: remove non-uptodate folio from the page cache in move_data_block Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: initialize the remaining fields of fwnode_handle in fwnode_init() Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Miguel Ojeda <ojeda(a)kernel.org> rust: str: clean unused import for Rust >= 1.98 Miguel Ojeda <ojeda(a)kernel.org> rust: str: use the "kernel vertical" imports style Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Olga Kornievskaia <okorniev(a)redhat.com> nfsd: update mtime/ctime on COPY in presence of delegated attributes Olga Kornievskaia <okorniev(a)redhat.com> nfsd: update mtime/ctime on CLONE in presense of delegated attributes Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Reject out-of-range B.cond targets ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Documentation/process/deprecated.rst | 7 + MAINTAINERS | 1 - Makefile | 7 +- arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 3 + arch/arm64/kvm/nested.c | 40 +- arch/arm64/lib/insn.c | 2 + arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/kvm/intc/eiointc.c | 6 + arch/loongarch/kvm/intc/ipi.c | 2 + arch/loongarch/kvm/intc/pch_pic.c | 2 + arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/pci/acpi.c | 2 + arch/powerpc/net/bpf_jit_comp.c | 4 +- arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/riscv/net/bpf_jit_comp64.c | 2 +- arch/riscv/net/bpf_jit_core.c | 3 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/asm-extable.h | 4 - arch/s390/include/asm/word-at-a-time.h | 22 - arch/s390/mm/extable.c | 18 - arch/x86/events/intel/uncore_snb.c | 7 - arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kernel/cpu/resctrl/monitor.c | 8 +- arch/x86/kvm/lapic.c | 49 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 47 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/pmu_intel.c | 6 +- arch/x86/kvm/vmx/vmx.c | 44 +- arch/x86/kvm/x86.c | 38 +- arch/x86/mm/init_64.c | 40 +- arch/x86/net/bpf_jit_comp.c | 5 +- block/bdev.c | 8 +- block/partitions/aix.c | 9 + block/partitions/of.c | 5 +- crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/chacha20poly1305.c | 11 +- crypto/drbg.c | 4 +- crypto/ecc.c | 31 +- crypto/krb5/krb5_api.c | 2 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 3 + drivers/android/binder.c | 19 +- drivers/android/binder/allocation.rs | 8 +- drivers/android/binder/error.rs | 23 +- drivers/android/binder/freeze.rs | 11 +- drivers/android/binder/node.rs | 10 +- drivers/android/binder/process.rs | 33 +- drivers/android/binder/rust_binder_events.c | 7 +- drivers/android/binder/stats.rs | 4 +- drivers/android/binder/thread.rs | 237 +++++---- drivers/android/binder/transaction.rs | 96 ++-- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/Kconfig | 1 - drivers/crypto/Makefile | 1 - drivers/crypto/amcc/crypto4xx_core.c | 88 ---- drivers/crypto/amcc/crypto4xx_core.h | 4 - drivers/crypto/amcc/crypto4xx_reg_def.h | 11 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/atmel-sha204a.c | 19 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 70 +-- drivers/crypto/hisilicon/Kconfig | 1 - drivers/crypto/hisilicon/trng/trng.c | 296 +---------- drivers/crypto/intel/qat/qat_420xx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c3xxxvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62x/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62xvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_common/adf_aer.c | 102 ++-- .../crypto/intel/qat/qat_common/adf_common_drv.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 18 + drivers/crypto/intel/qat/qat_common/adf_sriov.c | 12 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_dh895xccvf/adf_drv.c | 1 - drivers/crypto/loongson/Kconfig | 5 - drivers/crypto/loongson/Makefile | 1 - drivers/crypto/loongson/loongson-rng.c | 209 -------- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-sch.c | 32 +- drivers/hid/hid-appleir.c | 45 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-multitouch.c | 32 +- drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 2 +- drivers/hid/wacom_sys.c | 20 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/Kconfig | 3 + drivers/iio/adc/ad_sigma_delta.c | 39 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/Kconfig | 3 + drivers/iio/light/al3010.c | 10 +- drivers/iio/light/al3320a.c | 8 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/mpl115.c | 4 +- drivers/iio/proximity/vl53l0x-i2c.c | 7 +- drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/iio/temperature/tmp006.c | 2 +- drivers/infiniband/core/addr.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/serio/gscps2.c | 1 + drivers/input/touchscreen/ads7846.c | 5 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/intel/iommu.c | 29 +- drivers/iommu/intel/iommu.h | 11 + drivers/iommu/intel/nested.c | 9 +- drivers/iommu/intel/pasid.c | 190 ------- drivers/iommu/intel/pasid.h | 14 - drivers/iommu/intel/svm.c | 12 +- drivers/iommu/iommufd/eventq.c | 26 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/iommu/iommufd/iommufd_private.h | 2 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/usb/kalmia.c | 8 + drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/dwc/pcie-qcom.c | 6 + drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 36 +- drivers/pci/controller/pcie-mediatek.c | 65 ++- drivers/pci/iov.c | 6 + drivers/pci/quirks.c | 51 +- drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/media/ipu7/ipu7.c | 22 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci-sideband.c | 2 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 4 +- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/usbio.c | 8 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/video/fbdev/core/fbcon.c | 7 + drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/btrfs/btrfs_inode.h | 2 + fs/btrfs/extent-tree.c | 12 +- fs/btrfs/file.c | 25 +- fs/btrfs/inode.c | 61 ++- fs/btrfs/reflink.c | 4 +- fs/crypto/fscrypt_private.h | 84 +-- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 239 ++++----- fs/crypto/keysetup.c | 118 +++-- fs/exfat/dir.c | 13 +- fs/f2fs/checkpoint.c | 10 +- fs/f2fs/compress.c | 4 +- fs/f2fs/data.c | 33 +- fs/f2fs/f2fs.h | 30 +- fs/f2fs/gc.c | 50 +- fs/f2fs/inode.c | 17 +- fs/f2fs/node.c | 21 +- fs/f2fs/segment.c | 14 +- fs/f2fs/super.c | 4 +- fs/f2fs/xattr.c | 6 +- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 54 +- fs/fuse/dev_uring.c | 93 ++-- fs/fuse/dev_uring_i.h | 10 +- fs/fuse/fuse_dev_i.h | 1 + fs/fuse/notify.c | 434 ++++++++++++++++ fs/fuse/readdir.c | 85 +++- fs/hfs/bnode.c | 2 + fs/hfsplus/bnode.c | 2 + fs/isofs/rock.c | 11 + fs/libfs.c | 1 + fs/nfs/dir.c | 2 + fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 14 +- fs/nfsd/nfs4recover.c | 119 ++--- fs/nfsd/nfs4state.c | 66 ++- fs/nfsd/state.h | 1 + fs/nfsd/xdr4.h | 1 + fs/nilfs2/segment.c | 22 + fs/ntfs3/attrib.c | 14 + fs/ntfs3/dir.c | 2 +- fs/ntfs3/file.c | 30 +- fs/ntfs3/frecord.c | 59 ++- fs/ntfs3/fslog.c | 20 +- fs/ntfs3/inode.c | 15 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/resctrl/monitor.c | 37 +- fs/smb/client/cifs_swn.c | 316 ++++++++++-- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/smb2misc.c | 52 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/client/trace.h | 2 + fs/smb/server/smb2pdu.c | 101 ++-- fs/smb/server/vfs.c | 18 +- fs/smb/server/vfs_cache.c | 5 + fs/smb/server/vfs_cache.h | 2 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 14 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_defer.c | 2 +- fs/xfs/libxfs/xfs_dquot_buf.c | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/scrub/dirtree.c | 16 +- fs/xfs/scrub/dqiterate.c | 2 +- fs/xfs/scrub/inode_repair.c | 4 +- fs/xfs/scrub/rgsuper.c | 14 +- fs/xfs/scrub/rtbitmap.c | 2 +- fs/xfs/scrub/rtrefcount.c | 2 +- fs/xfs/scrub/rtrmap.c | 8 +- fs/xfs/scrub/scrub.h | 6 +- fs/xfs/scrub/xfarray.c | 3 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_log_recover.c | 15 +- fs/xfs/xfs_qm.c | 5 +- fs/xfs/xfs_reflink.c | 36 ++ include/asm-generic/rqspinlock.h | 14 +- include/crypto/drbg.h | 18 +- include/linux/damon.h | 8 +- include/linux/filter.h | 15 +- include/linux/fs.h | 5 + include/linux/fwnode.h | 2 + include/linux/gfp.h | 4 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/page_ext.h | 19 +- include/linux/slab.h | 78 ++- include/linux/vfio_pci_core.h | 15 +- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/tcp_ao.h | 1 + include/sound/hda_codec.h | 1 + include/trace/events/f2fs.h | 19 +- init/Kconfig | 1 + io_uring/io-wq.c | 2 +- io_uring/nop.c | 8 +- io_uring/rw.c | 12 +- kernel/audit.c | 21 +- kernel/audit_fsnotify.c | 4 - kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/core.c | 68 ++- kernel/bpf/devmap.c | 7 + kernel/bpf/dispatcher.c | 2 +- kernel/events/core.c | 19 +- kernel/futex/requeue.c | 6 - kernel/module/decompress.c | 2 + kernel/sched/fair.c | 2 +- kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/time/timekeeping.c | 7 +- kernel/trace/trace_events_filter.c | 6 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shmem.c | 14 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swap_cgroup.c | 2 + mm/swapfile.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/hci_conn.c | 21 +- net/bluetooth/hci_sync.c | 137 ++++- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 80 +-- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 12 +- net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_ao.c | 5 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_flow_table_core.c | 13 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/sched/sch_dualpi2.c | 11 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- rust/kernel/block/mq/gen_disk.rs | 20 +- rust/kernel/cpufreq.rs | 2 +- rust/kernel/str.rs | 24 +- rust/kernel/uaccess.rs | 3 + scripts/rustdoc_test_builder.rs | 16 +- security/landlock/net.c | 1 + sound/aoa/fabrics/layout.c | 6 + sound/core/compress_offload.c | 13 +- sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/hda/codecs/hdmi/hdmi.c | 9 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 77 ++- sound/hda/codecs/side-codecs/cs35l41_hda.h | 5 + sound/hda/common/jack.c | 6 + sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/mixer_quirks.c | 102 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/usb/usx2y/us144mkii.c | 17 +- sound/usb/usx2y/us144mkii_capture.c | 2 +- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/landlock/audit.h | 39 +- tools/testing/selftests/landlock/audit_test.c | 2 + tools/testing/selftests/landlock/net_test.c | 62 +++ tools/testing/selftests/landlock/ptrace_test.c | 1 + .../selftests/landlock/scoped_abstract_unix_test.c | 1 + tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + 474 files changed, 5856 insertions(+), 3472 deletions(-)

2 days, 15 hours

[PATCH 6.12 000/357] 6.12.96-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.96 release. There are 357 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 19 Jul 2026 10:17:43 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.96-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.96-rc2 Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap bmbt forks if they are MAXLEVELS tall Darrick J. Wong <djwong(a)kernel.org> xfs: fully check the parent handle when it points to the rootdir Darrick J. Wong <djwong(a)kernel.org> xfs: clamp timestamp nanoseconds correctly Darrick J. Wong <djwong(a)kernel.org> xfs: set xfarray killable sort correctly Darrick J. Wong <djwong(a)kernel.org> xfs: don't wrap around quota ids in dqiterate Darrick J. Wong <djwong(a)kernel.org> xfs: resample the data fork mapping after cycling ILOCK Weiming Shi <bestswngs(a)gmail.com> xfs: fail recovery on a committed log item with no regions Andrey Albershteyn <aalbersh(a)kernel.org> xfs: fix null pointer dereference in tracepoint Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: reject overlapping data areas in SMB2 responses Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Deepanshu Kartikey <kartikey406(a)gmail.com> fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fsync files by syncing parent inodes Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Krzysztof Karas <krzysztof.karas(a)intel.com> drm/i915: ensure segment offset never exceeds allowed max Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing Christoph Hellwig <hch(a)lst.de> block: fix queue freeze vs limits lock order in sysfs store methods Christoph Hellwig <hch(a)lst.de> block: add a store_limit operations for sysfs entries Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix xfrm offload feature setup on active-backup mode NeilBrown <neil(a)brown.name> nfsd: change nfs4_client_to_reclaim() to allocate data NeilBrown <neilb(a)ownmail.net> nfsd: move name lookup out of nfsd4_list_rec_dir() John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied John Stultz <jstultz(a)google.com> locking/rtmutex: Make sure we wake anything on the wake_q when we release the lock->wait_lock Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jonathan Curley <jcurley(a)purestorage.com> NFSv4/flexfiles: Add data structure support for striped layouts Jonathan Curley <jcurley(a)purestorage.com> NFSv4/flexfiles: Remove cred local variable dependency Mike Snitzer <snitzer(a)kernel.org> nfs_common: rename functions that invalidate LOCALIO nfs_clients Mike Snitzer <snitzer(a)kernel.org> nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Keshav Verma <iganschel(a)gmail.com> f2fs: fix listxattr handling of corrupted xattr entries Chao Yu <chao(a)kernel.org> f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Ruipeng Qi <ruipengqi3(a)gmail.com> f2fs: fix potential deadlock in f2fs_balance_fs() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: initialize the remaining fields of fwnode_handle in fwnode_init() Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: fix generic IRQ chip leak on remove Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Ye Zhang <ye.zhang(a)rock-chips.com> gpio: rockchip: change the GPIO version judgment logic Tiezhu Yang <yangtiezhu(a)loongson.cn> drm/amd: Fix set but not used warnings Mikhail Dmitrichenko <mdmitrichenko(a)astralinux.ru> bcachefs: avoid truncating fiemap extent length Wentao Guan <guanwentao(a)uniontech.com> perf: Fix dangling cgroup pointer in cpuctx backport Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Scott Mayhew <smayhew(a)redhat.com> nfsd: fix file change detection in CB_GETATTR Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Reject out-of-range B.cond targets ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Makefile | 7 +- arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/lib/insn.c | 2 + arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/pci/acpi.c | 2 + arch/riscv/kernel/entry.S | 7 +- arch/x86/kernel/cpu/resctrl/monitor.c | 45 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/vmx.c | 41 +- arch/x86/kvm/x86.c | 3 - block/bdev.c | 8 +- block/blk-sysfs.c | 108 ++-- block/partitions/aix.c | 9 + crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/drbg.c | 4 +- crypto/ecc.c | 31 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 3 + drivers/android/binder.c | 19 +- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 37 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 4 +- drivers/crypto/intel/qat/qat_common/adf_init.c | 16 + drivers/crypto/intel/qat/qat_common/adf_sriov.c | 12 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-rockchip.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/i915/i915_mm.c | 4 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/wacom_sys.c | 12 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/al3010.c | 2 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/bonding/bond_netlink.c | 16 +- drivers/net/usb/kalmia.c | 8 + drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 1 - drivers/pci/quirks.c | 51 +- drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 4 +- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/video/fbdev/core/fbcon.c | 7 + drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/bcachefs/fs.c | 8 +- fs/btrfs/extent-tree.c | 12 +- fs/exfat/dir.c | 13 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 29 ++ fs/f2fs/f2fs.h | 1 + fs/f2fs/gc.c | 50 +- fs/f2fs/inode.c | 30 +- fs/f2fs/segment.c | 8 + fs/f2fs/xattr.c | 6 +- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 11 +- fs/hfs/bnode.c | 2 + fs/hfsplus/bnode.c | 2 + fs/isofs/rock.c | 11 + fs/nfs/dir.c | 2 + fs/nfs/flexfilelayout/flexfilelayout.c | 153 +++--- fs/nfs/flexfilelayout/flexfilelayout.h | 27 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 54 +- fs/nfs/localio.c | 2 +- fs/nfs_common/nfslocalio.c | 8 +- fs/nfsd/localio.c | 2 + fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4recover.c | 118 ++--- fs/nfsd/nfs4state.c | 35 +- fs/nfsd/nfsctl.c | 4 +- fs/nilfs2/segment.c | 22 + fs/ntfs3/attrib.c | 14 + fs/ntfs3/dir.c | 2 +- fs/ntfs3/file.c | 30 +- fs/ntfs3/frecord.c | 59 ++- fs/ntfs3/fslog.c | 20 +- fs/ntfs3/inode.c | 10 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/smb2misc.c | 52 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/server/smb2pdu.c | 101 ++-- fs/smb/server/vfs.c | 18 +- fs/smb/server/vfs_cache.c | 5 + fs/smb/server/vfs_cache.h | 2 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 14 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_defer.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/scrub/dirtree.c | 16 +- fs/xfs/scrub/dqiterate.c | 2 +- fs/xfs/scrub/inode_repair.c | 4 +- fs/xfs/scrub/scrub.h | 6 +- fs/xfs/scrub/xfarray.c | 3 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_log_recover.c | 15 +- fs/xfs/xfs_qm.c | 5 +- fs/xfs/xfs_reflink.c | 36 ++ include/crypto/drbg.h | 18 +- include/linux/damon.h | 8 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 5 + include/linux/fwnode.h | 2 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/nfslocalio.h | 7 +- include/linux/vfio_pci_core.h | 15 +- include/net/bonding.h | 1 + init/Kconfig | 1 + io_uring/io-wq.c | 2 +- kernel/audit.c | 21 +- kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/devmap.c | 7 + kernel/events/core.c | 19 +- kernel/locking/rtmutex.c | 18 +- kernel/locking/rtmutex_api.c | 2 +- kernel/module/decompress.c | 2 + kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/trace/trace_events_filter.c | 6 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swapfile.c | 1 + mm/vmalloc.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 36 +- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 9 + net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- security/apparmor/net.c | 1 + sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/mixer_quirks.c | 101 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + 328 files changed, 3358 insertions(+), 1646 deletions(-)

2 days, 15 hours

[PATCH 6.18 000/480] 6.18.39-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.39 release. There are 480 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 18 Jul 2026 13:30:01 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.39-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.39-rc1 Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> timekeeping: Register default clocksource before taking tk_core.lock Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Adam Li <adamli(a)os.amperecomputing.com> sched/fair: Only update stats for allowed CPUs when looking for dst group Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid queue->stopped races and set/read that value under lock Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues Chris Mason <clm(a)meta.com> fuse-uring: end fuse_req on io-uring cancel task work Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix moving cancelled entry to ent_in_userspace list Chris Mason <clm(a)meta.com> fuse-uring: fix data races on ring->ready Chris Mason <clm(a)meta.com> fuse-uring: fix EFAULT clobber in fuse_uring_commit Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: fix io-uring background queue dispatch on request completion Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Samuel Moelius <sam.moelius(a)trailofbits.com> fuse: avoid 32-bit prune notification count wrap Matthew R. Ochs <mochs(a)nvidia.com> fuse: back uncached readdir buffers with pages Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Maher Sanalla <msanalla(a)nvidia.com> RDMA/core: Fix broadcast address falsely detected as local Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Xu Rao <raoxu(a)uniontech.com> Input: gscps2 - advance receive buffer write index Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Kris Bahnsen <kris(a)embeddedTS.com> Input: ads7846 - don't use scratch for tx_buf when clearing register Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: mark I2C adapter when hardware is powered down Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Oliver Upton <oupton(a)kernel.org> KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier Sean Christopherson <seanjc(a)google.com> KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Xuanqing Shi <1356292400(a)qq.com> KVM: VMX: Handle bad values on proxied writes to LBR MSRs Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Sean Christopherson <seanjc(a)google.com> KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated Sean Christopherson <seanjc(a)google.com> KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Add missing slots_lock for device register/unregister Marc Zyngier <maz(a)kernel.org> KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Filter dealloc records in audit_count_records() Mickaël Salaün <mic(a)digikod.net> landlock: Set audit_net.sk for socket access checks Ricardo Robaina <rrobaina(a)redhat.com> audit: fix removal of dangling executable rules Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Break the loop on failure in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_veventq_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set veventq_depth upper bound Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Fix data_len byte-count vs element-count mismatch Kai Aizen <kai.aizen.dev(a)gmail.com> iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Avoid WARNING in sva unbind path Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Remove broken and unused loongson-rng Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Ketan <ketan.kishore(a)oss.qualcomm.com> mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Define DIRECT_MAP_PHYSMEM_END Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Gabriele Monaco <gmonaco(a)redhat.com> rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Lee Jia Jie <jiajie.lee(a)starlabs.sg> perf/aux: Fix page UAF in map_range() Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing David Hildenbrand (Arm) <david(a)kernel.org> x86/mm: Fix freeing of PMD-sized vmemmap pages Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - factor out AER reset helpers Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - skip restart for down devices Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - handle sysfs-triggered reset callbacks Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - centralize bus master enable Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Select CRYPTO_RNG Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Eric Biggers <ebiggers(a)kernel.org> crypto: hisi-trng - Remove crypto_rng interface Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Eric Biggers <ebiggers(a)kernel.org> crypto: crypto4xx - Remove insecure and unused rng_alg Xiaonan Zhao <ngochuongbui67(a)gmail.com> crypto: chacha20poly1305 - validate poly1305 template argument Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Qu Wenruo <wqu(a)suse.com> btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> block: partitions: fix of_node refcount leak in of_partition() Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer dirty packs for eBPF allocations Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer packs that won't trigger an IBPB flush on allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Skip redundant IBPB in pack allocator Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Restrict JIT predictor flush to cBPF Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Enable IBPB flush on BPF JIT allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Support for hardening against JIT spraying Alice Ryhl <aliceryhl(a)google.com> rust_binder: fix BINDER_GET_EXTENDED_ERROR Alice Ryhl <aliceryhl(a)google.com> rust_binder: introduce TransactionInfo Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: shmem: fix potential livelock issue for shmem direct swapin Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure HE WEI (ギカク) <skyexpoc(a)gmail.com> usb: misc: usbio: bound bulk IN response length to the received transfer Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Dawei Feng <dawei.feng(a)seu.edu.cn> xfs: fix memory leak in xfs_dqinode_metadir_create() Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: appleir: fix UAF on pending key_up_timer in remove() Trung Nguyen <trungnh(a)cystack.net> HID: multitouch: fix out-of-bounds bit access on mt_io_flags Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert Oleg Makarenko <oleg(a)makarenk.ooo> HID: pidff: Use correct effect type in effect update Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Heiko Carstens <hca(a)linux.ibm.com> s390: Revert support for DCACHE_WORD_ACCESS Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() John Hubbard <jhubbard(a)nvidia.com> libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: resolve SWN tcon from live registrations Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Deepanshu Kartikey <kartikey406(a)gmail.com> fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fsync files by syncing parent inodes Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Fix race condition during PASID entry replacement Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Runyu Xiao <runyu.xiao(a)seu.edu.cn> Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Adrian Bente <adibente(a)gmail.com> netfilter: flowtable: fix offloaded ct timeout never being extended Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: ebtables: zero chainstack array Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Michael Wigham <michael(a)wigham.net> io_uring/rw: preserve partial result for iopoll Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Vasileios Almpanis <vasilisalmpanis(a)gmail.com> io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: sch: use raw_spinlock_t in the irq startup path Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Michael Bommarito <michael.bommarito(a)gmail.com> crypto: krb5 - filter out async aead implementations at alloc Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: media: ipu7: fix double-free and use-after-free in error paths Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Cen Zhang <zzzccc427(a)gmail.com> usb: misc: usbio: fix disconnect UAF in client teardown Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Michael Bommarito <michael.bommarito(a)gmail.com> tcp: restore RCU grace period in tcp_ao_destroy_sock Marco Nenciarini <mnencia(a)kcore.it> PCI/IOV: Skip VF Resizable BAR restore on read error Yadu M G <yadu.mg(a)oss.qualcomm.com> PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: mediatek: Fix IRQ domain leak when port fails to enable Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Fix resource leaks on probe failure Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Xu Rao <raoxu(a)uniontech.com> xhci: sideband: fix ring sg table pages leak 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Alice Ryhl <aliceryhl(a)google.com> rust_binder: clear freeze listener on node removal Keshav Verma <iganschel(a)gmail.com> rust_binder: synchronize Rust Binder stats with freeze commands Keshav Verma <iganschel(a)gmail.com> rust_binder: reject context manager self-transaction Hyunwoo Kim <imv4bel(a)gmail.com> rust_binder: use a u64 stride when cleaning up the offsets array Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match WenTao Liang <vulab(a)iscas.ac.cn> ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW Huacai Chen <chenhuacai(a)kernel.org> ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson Cameron Graham <cam.graham(a)gmail.com> ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda/cs35l41: Fix firmware load work teardown Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Add Focusrite ISA C8X support Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: compress: Fix task creation error unwind Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: aoa: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping HyeongJun An <sammiee5311(a)gmail.com> ALSA: usx2y: us144mkii: fix work UAF on disconnect Stepan Ionichev <sozdayvek(a)gmail.com> iio: temperature: tmp006: use devm_iio_trigger_register Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Stepan Ionichev <sozdayvek(a)gmail.com> iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths Biren Pandya <birenpandya(a)gmail.com> iio: pressure: mpl115: fix runtime PM leak on read error David Carlier <devnexen(a)gmail.com> iio: pressure: bmp280: zero-init bmp580 trigger handler buffer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3320a: read both ALS ADC registers again Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3320a: add missing REGMAP_I2C to Kconfig Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3010: read both ALS ADC registers again Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3010: add missing REGMAP_I2C to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3000a: add missing REGMAP_I2C to Kconfig Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Dan Carpenter <error27(a)gmail.com> iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() Dan Carpenter <error27(a)gmail.com> iio: core: fix uninitialized data in debugfs Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix CS held asserted and state leaks Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: adc: ad7768-1: Select GPIOLIB Samuel Moelius <samuel.moelius(a)trailofbits.com> iio: adc: ad7380: select REGMAP Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Gary Guo <gary(a)garyguo.net> rust: doctest: fix incorrect pattern in replacement Haoze Xie <royenheart(a)gmail.com> rust: block: fix GenDisk cleanup paths Miguel Ojeda <ojeda(a)kernel.org> rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Carlos López <clopez(a)suse.de> KVM: x86: Unconditionally recompute CR8 intercept on PPR update Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Move update_cr8_intercept() to lapic.c Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Randy Dunlap <rdunlap(a)infradead.org> slab: recognize @GFP parameter as optional in kernel-doc Linus Torvalds <torvalds(a)linux-foundation.org> default_gfp(): avoid using the "newfangled" __VA_OPT__ trick Linus Torvalds <torvalds(a)linux-foundation.org> add default_gfp() helper macro and use it in the new *alloc_obj() helpers Kees Cook <kees(a)kernel.org> slab: Introduce kmalloc_flex() and family Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing NeilBrown <neil(a)brown.name> nfsd: change nfs4_client_to_reclaim() to allocate data NeilBrown <neilb(a)ownmail.net> nfsd: move name lookup out of nfsd4_list_rec_dir() Xingquan Liu <b1n(a)b1n.io> net/sched: dualpi2: fix GSO backlog accounting Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Chao Yu <chao(a)kernel.org> f2fs: detect more inconsistent cases in sanity_check_node_footer() YH Lin <yhli(a)google.com> f2fs: optimize trace_f2fs_write_checkpoint with enums Chao Yu <chao(a)kernel.org> f2fs: introduce f2fs_schedule_timeout() Chao Yu <chao(a)kernel.org> f2fs: use memalloc_retry_wait() as much as possible Keshav Verma <iganschel(a)gmail.com> f2fs: fix listxattr handling of corrupted xattr entries Chao Yu <chao(a)kernel.org> f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Ruipeng Qi <ruipengqi3(a)gmail.com> f2fs: fix potential deadlock in f2fs_balance_fs() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: remove non-uptodate folio from the page cache in move_data_block Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: initialize the remaining fields of fwnode_handle in fwnode_init() Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Miguel Ojeda <ojeda(a)kernel.org> rust: str: clean unused import for Rust >= 1.98 Miguel Ojeda <ojeda(a)kernel.org> rust: str: use the "kernel vertical" imports style Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Olga Kornievskaia <okorniev(a)redhat.com> nfsd: update mtime/ctime on COPY in presence of delegated attributes Olga Kornievskaia <okorniev(a)redhat.com> nfsd: update mtime/ctime on CLONE in presense of delegated attributes Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Reject out-of-range B.cond targets ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Documentation/process/deprecated.rst | 7 + MAINTAINERS | 1 - Makefile | 7 +- arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 3 + arch/arm64/kvm/nested.c | 40 +- arch/arm64/lib/insn.c | 2 + arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/kvm/intc/eiointc.c | 6 + arch/loongarch/kvm/intc/ipi.c | 2 + arch/loongarch/kvm/intc/pch_pic.c | 2 + arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/pci/acpi.c | 2 + arch/powerpc/net/bpf_jit_comp.c | 4 +- arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/riscv/net/bpf_jit_comp64.c | 2 +- arch/riscv/net/bpf_jit_core.c | 3 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/asm-extable.h | 4 - arch/s390/include/asm/word-at-a-time.h | 22 - arch/s390/mm/extable.c | 18 - arch/x86/events/intel/uncore_snb.c | 7 - arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kernel/cpu/resctrl/monitor.c | 8 +- arch/x86/kvm/lapic.c | 49 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 47 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/pmu_intel.c | 6 +- arch/x86/kvm/vmx/vmx.c | 44 +- arch/x86/kvm/x86.c | 38 +- arch/x86/mm/init_64.c | 40 +- arch/x86/net/bpf_jit_comp.c | 5 +- block/bdev.c | 8 +- block/partitions/aix.c | 9 + block/partitions/of.c | 5 +- crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/chacha20poly1305.c | 11 +- crypto/drbg.c | 4 +- crypto/ecc.c | 31 +- crypto/krb5/krb5_api.c | 2 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 3 + drivers/android/binder.c | 19 +- drivers/android/binder/allocation.rs | 8 +- drivers/android/binder/error.rs | 23 +- drivers/android/binder/freeze.rs | 11 +- drivers/android/binder/node.rs | 10 +- drivers/android/binder/process.rs | 33 +- drivers/android/binder/rust_binder_events.c | 7 +- drivers/android/binder/stats.rs | 4 +- drivers/android/binder/thread.rs | 237 +++++---- drivers/android/binder/transaction.rs | 96 ++-- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/Kconfig | 1 - drivers/crypto/Makefile | 1 - drivers/crypto/amcc/crypto4xx_core.c | 88 ---- drivers/crypto/amcc/crypto4xx_core.h | 4 - drivers/crypto/amcc/crypto4xx_reg_def.h | 11 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/atmel-sha204a.c | 19 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 70 +-- drivers/crypto/hisilicon/Kconfig | 1 - drivers/crypto/hisilicon/trng/trng.c | 296 +---------- drivers/crypto/intel/qat/qat_420xx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c3xxxvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62x/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62xvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_common/adf_aer.c | 102 ++-- .../crypto/intel/qat/qat_common/adf_common_drv.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 18 + drivers/crypto/intel/qat/qat_common/adf_sriov.c | 12 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_dh895xccvf/adf_drv.c | 1 - drivers/crypto/loongson/Kconfig | 5 - drivers/crypto/loongson/Makefile | 1 - drivers/crypto/loongson/loongson-rng.c | 209 -------- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-sch.c | 32 +- drivers/hid/hid-appleir.c | 45 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-multitouch.c | 32 +- drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 2 +- drivers/hid/wacom_sys.c | 20 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/Kconfig | 3 + drivers/iio/adc/ad_sigma_delta.c | 39 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/Kconfig | 3 + drivers/iio/light/al3010.c | 10 +- drivers/iio/light/al3320a.c | 8 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/mpl115.c | 4 +- drivers/iio/proximity/vl53l0x-i2c.c | 7 +- drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/iio/temperature/tmp006.c | 2 +- drivers/infiniband/core/addr.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/serio/gscps2.c | 1 + drivers/input/touchscreen/ads7846.c | 5 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/intel/iommu.c | 29 +- drivers/iommu/intel/iommu.h | 11 + drivers/iommu/intel/nested.c | 9 +- drivers/iommu/intel/pasid.c | 190 ------- drivers/iommu/intel/pasid.h | 14 - drivers/iommu/intel/svm.c | 12 +- drivers/iommu/iommufd/eventq.c | 26 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/iommu/iommufd/iommufd_private.h | 2 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/usb/kalmia.c | 8 + drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/dwc/pcie-qcom.c | 6 + drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 36 +- drivers/pci/controller/pcie-mediatek.c | 65 ++- drivers/pci/iov.c | 6 + drivers/pci/quirks.c | 51 +- drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/media/ipu7/ipu7.c | 22 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci-sideband.c | 2 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 4 +- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/usbio.c | 8 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/video/fbdev/core/fbcon.c | 7 + drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/btrfs/btrfs_inode.h | 2 + fs/btrfs/extent-tree.c | 12 +- fs/btrfs/file.c | 25 +- fs/btrfs/inode.c | 61 ++- fs/btrfs/reflink.c | 4 +- fs/crypto/fscrypt_private.h | 84 +-- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 239 ++++----- fs/crypto/keysetup.c | 118 +++-- fs/exfat/dir.c | 13 +- fs/f2fs/checkpoint.c | 10 +- fs/f2fs/compress.c | 4 +- fs/f2fs/data.c | 33 +- fs/f2fs/f2fs.h | 30 +- fs/f2fs/gc.c | 50 +- fs/f2fs/inode.c | 17 +- fs/f2fs/node.c | 21 +- fs/f2fs/segment.c | 14 +- fs/f2fs/super.c | 4 +- fs/f2fs/xattr.c | 6 +- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 54 +- fs/fuse/dev_uring.c | 93 ++-- fs/fuse/dev_uring_i.h | 10 +- fs/fuse/fuse_dev_i.h | 1 + fs/fuse/notify.c | 434 ++++++++++++++++ fs/fuse/readdir.c | 85 +++- fs/hfs/bnode.c | 2 + fs/hfsplus/bnode.c | 2 + fs/isofs/rock.c | 11 + fs/libfs.c | 1 + fs/nfs/dir.c | 2 + fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 14 +- fs/nfsd/nfs4recover.c | 119 ++--- fs/nfsd/nfs4state.c | 66 ++- fs/nfsd/state.h | 1 + fs/nfsd/xdr4.h | 1 + fs/nilfs2/segment.c | 22 + fs/ntfs3/attrib.c | 14 + fs/ntfs3/dir.c | 2 +- fs/ntfs3/file.c | 30 +- fs/ntfs3/frecord.c | 59 ++- fs/ntfs3/fslog.c | 20 +- fs/ntfs3/inode.c | 15 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/resctrl/monitor.c | 37 +- fs/smb/client/cifs_swn.c | 316 ++++++++++-- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/smb2misc.c | 32 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/client/trace.h | 2 + fs/smb/server/smb2pdu.c | 101 ++-- fs/smb/server/vfs.c | 18 +- fs/smb/server/vfs_cache.c | 5 + fs/smb/server/vfs_cache.h | 2 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 14 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_dquot_buf.c | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_log_recover.c | 6 +- fs/xfs/xfs_qm.c | 5 +- include/asm-generic/rqspinlock.h | 14 +- include/crypto/drbg.h | 18 +- include/linux/damon.h | 8 +- include/linux/filter.h | 15 +- include/linux/fs.h | 5 + include/linux/fwnode.h | 2 + include/linux/gfp.h | 4 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/page_ext.h | 19 +- include/linux/slab.h | 78 ++- include/linux/vfio_pci_core.h | 15 +- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/tcp_ao.h | 1 + include/sound/hda_codec.h | 1 + include/trace/events/f2fs.h | 19 +- init/Kconfig | 1 + io_uring/io-wq.c | 2 +- io_uring/nop.c | 8 +- io_uring/rw.c | 12 +- kernel/audit.c | 21 +- kernel/audit_fsnotify.c | 4 - kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/core.c | 68 ++- kernel/bpf/devmap.c | 7 + kernel/bpf/dispatcher.c | 2 +- kernel/events/core.c | 19 +- kernel/futex/requeue.c | 6 - kernel/module/decompress.c | 2 + kernel/sched/fair.c | 2 +- kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/time/timekeeping.c | 7 +- kernel/trace/trace_events_filter.c | 6 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shmem.c | 14 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swap_cgroup.c | 2 + mm/swapfile.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/hci_conn.c | 21 +- net/bluetooth/hci_sync.c | 137 ++++- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 80 +-- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 12 +- net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_ao.c | 5 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_flow_table_core.c | 13 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/sched/sch_dualpi2.c | 11 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- rust/kernel/block/mq/gen_disk.rs | 20 +- rust/kernel/cpufreq.rs | 2 +- rust/kernel/str.rs | 24 +- rust/kernel/uaccess.rs | 3 + scripts/rustdoc_test_builder.rs | 16 +- security/landlock/net.c | 1 + sound/aoa/fabrics/layout.c | 6 + sound/core/compress_offload.c | 13 +- sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/hda/codecs/hdmi/hdmi.c | 9 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 77 ++- sound/hda/codecs/side-codecs/cs35l41_hda.h | 5 + sound/hda/common/jack.c | 6 + sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/mixer_quirks.c | 102 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/usb/usx2y/us144mkii.c | 17 +- sound/usb/usx2y/us144mkii_capture.c | 2 +- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/landlock/audit.h | 39 +- tools/testing/selftests/landlock/audit_test.c | 2 + tools/testing/selftests/landlock/net_test.c | 62 +++ tools/testing/selftests/landlock/ptrace_test.c | 1 + .../selftests/landlock/scoped_abstract_unix_test.c | 1 + tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + 463 files changed, 5755 insertions(+), 3449 deletions(-)

3 days, 9 hours

[PATCH 6.12 000/349] 6.12.96-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.96 release. There are 349 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 18 Jul 2026 13:30:01 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.96-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.96-rc1 Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Define DIRECT_MAP_PHYSMEM_END Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Deepanshu Kartikey <kartikey406(a)gmail.com> fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fsync files by syncing parent inodes Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <zhengqi.arch(a)bytedance.com> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Krzysztof Karas <krzysztof.karas(a)intel.com> drm/i915: ensure segment offset never exceeds allowed max Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing Christoph Hellwig <hch(a)lst.de> block: fix queue freeze vs limits lock order in sysfs store methods Christoph Hellwig <hch(a)lst.de> block: add a store_limit operations for sysfs entries Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix xfrm offload feature setup on active-backup mode NeilBrown <neil(a)brown.name> nfsd: change nfs4_client_to_reclaim() to allocate data NeilBrown <neilb(a)ownmail.net> nfsd: move name lookup out of nfsd4_list_rec_dir() John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied John Stultz <jstultz(a)google.com> locking/rtmutex: Make sure we wake anything on the wake_q when we release the lock->wait_lock Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jonathan Curley <jcurley(a)purestorage.com> NFSv4/flexfiles: Add data structure support for striped layouts Jonathan Curley <jcurley(a)purestorage.com> NFSv4/flexfiles: Remove cred local variable dependency Mike Snitzer <snitzer(a)kernel.org> nfs_common: rename functions that invalidate LOCALIO nfs_clients Mike Snitzer <snitzer(a)kernel.org> nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Keshav Verma <iganschel(a)gmail.com> f2fs: fix listxattr handling of corrupted xattr entries Chao Yu <chao(a)kernel.org> f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Ruipeng Qi <ruipengqi3(a)gmail.com> f2fs: fix potential deadlock in f2fs_balance_fs() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> device property: initialize the remaining fields of fwnode_handle in fwnode_init() Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: fix generic IRQ chip leak on remove Marco Scardovi <scardracs(a)disroot.org> gpio: rockchip: teardown bugs and resource leaks Ye Zhang <ye.zhang(a)rock-chips.com> gpio: rockchip: change the GPIO version judgment logic Tiezhu Yang <yangtiezhu(a)loongson.cn> drm/amd: Fix set but not used warnings Mikhail Dmitrichenko <mdmitrichenko(a)astralinux.ru> bcachefs: avoid truncating fiemap extent length Wentao Guan <guanwentao(a)uniontech.com> perf: Fix dangling cgroup pointer in cpuctx backport Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Scott Mayhew <smayhew(a)redhat.com> nfsd: fix file change detection in CB_GETATTR Daniel Borkmann <daniel(a)iogearbox.net> bpf, arm64: Reject out-of-range B.cond targets ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Makefile | 7 +- arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/lib/insn.c | 2 + arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/pci/acpi.c | 2 + arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/x86/kernel/cpu/resctrl/monitor.c | 45 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/vmx.c | 41 +- arch/x86/kvm/x86.c | 3 - block/bdev.c | 8 +- block/blk-sysfs.c | 108 ++-- block/partitions/aix.c | 9 + crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/drbg.c | 4 +- crypto/ecc.c | 31 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 3 + drivers/android/binder.c | 19 +- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 37 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 4 +- drivers/crypto/intel/qat/qat_common/adf_init.c | 16 + drivers/crypto/intel/qat/qat_common/adf_sriov.c | 12 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-rockchip.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/i915/i915_mm.c | 4 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/wacom_sys.c | 12 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/al3010.c | 2 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/bonding/bond_netlink.c | 16 +- drivers/net/usb/kalmia.c | 8 + drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 1 - drivers/pci/quirks.c | 51 +- drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 4 +- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/video/fbdev/core/fbcon.c | 7 + drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/bcachefs/fs.c | 8 +- fs/btrfs/extent-tree.c | 12 +- fs/exfat/dir.c | 13 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 29 ++ fs/f2fs/f2fs.h | 1 + fs/f2fs/gc.c | 50 +- fs/f2fs/inode.c | 30 +- fs/f2fs/segment.c | 8 + fs/f2fs/xattr.c | 6 +- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 11 +- fs/hfs/bnode.c | 2 + fs/hfsplus/bnode.c | 2 + fs/isofs/rock.c | 11 + fs/nfs/dir.c | 2 + fs/nfs/flexfilelayout/flexfilelayout.c | 153 +++--- fs/nfs/flexfilelayout/flexfilelayout.h | 27 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 54 +- fs/nfs/localio.c | 2 +- fs/nfs_common/nfslocalio.c | 8 +- fs/nfsd/localio.c | 2 + fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4recover.c | 118 ++--- fs/nfsd/nfs4state.c | 35 +- fs/nfsd/nfsctl.c | 4 +- fs/nilfs2/segment.c | 22 + fs/ntfs3/attrib.c | 14 + fs/ntfs3/dir.c | 2 +- fs/ntfs3/file.c | 30 +- fs/ntfs3/frecord.c | 59 ++- fs/ntfs3/fslog.c | 20 +- fs/ntfs3/inode.c | 10 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/smb2misc.c | 32 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/server/smb2pdu.c | 101 ++-- fs/smb/server/vfs.c | 18 +- fs/smb/server/vfs_cache.c | 5 + fs/smb/server/vfs_cache.h | 2 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 14 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_log_recover.c | 6 +- fs/xfs/xfs_qm.c | 5 +- include/crypto/drbg.h | 18 +- include/linux/damon.h | 8 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 5 + include/linux/fwnode.h | 2 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/nfslocalio.h | 7 +- include/linux/vfio_pci_core.h | 15 +- include/net/bonding.h | 1 + init/Kconfig | 1 + io_uring/io-wq.c | 2 +- kernel/audit.c | 21 +- kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/devmap.c | 7 + kernel/events/core.c | 19 +- kernel/locking/rtmutex.c | 18 +- kernel/locking/rtmutex_api.c | 2 +- kernel/module/decompress.c | 2 + kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/trace/trace_events_filter.c | 6 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swapfile.c | 1 + mm/vmalloc.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 36 +- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 9 + net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- security/apparmor/net.c | 1 + sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/mixer_quirks.c | 101 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + 322 files changed, 3289 insertions(+), 1627 deletions(-)

3 days, 9 hours

[PATCH 7.1 000/518] 7.1.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.4 release. There are 518 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 18 Jul 2026 13:30:01 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.4-rc1 Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> timekeeping: Register default clocksource before taking tk_core.lock Rong Zhang <i(a)rong.moe> ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid queue->stopped races and set/read that value under lock Bernd Schubert <bernd(a)bsbernd.com> fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues Chris Mason <clm(a)meta.com> fuse-uring: end fuse_req on io-uring cancel task work Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix moving cancelled entry to ent_in_userspace list Chris Mason <clm(a)meta.com> fuse-uring: fix data races on ring->ready Chris Mason <clm(a)meta.com> fuse-uring: fix EFAULT clobber in fuse_uring_commit Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req Joanne Koong <joannelkoong(a)gmail.com> fuse: don't block in fuse_get_dev() for non-sync_init case Joanne Koong <joannelkoong(a)gmail.com> fuse: fix io-uring background queue dispatch on request completion Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before returning from fuse_ref_folio() Miklos Szeredi <mszeredi(a)redhat.com> fuse: do not use start_removing_noperm() Alberto Ruiz <aruiz(a)redhat.com> fuse: fix device node leak in cuse_process_init_reply() Miklos Szeredi <mszeredi(a)redhat.com> Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()" Samuel Moelius <sam.moelius(a)trailofbits.com> fuse: avoid 32-bit prune notification count wrap Matthew R. Ochs <mochs(a)nvidia.com> fuse: back uncached readdir buffers with pages Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/siw: bound Read Response placement to the RREAD length Maher Sanalla <msanalla(a)nvidia.com> RDMA/core: Fix broadcast address falsely detected as local Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplecontrol - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maplemouse - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: maple_keyb - set driver data before registering input device Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix multi-touch slot corruption Florian Fuchs <fuchsfl(a)gmail.com> Input: maplemouse - fix NULL pointer dereference in open() Xu Rao <raoxu(a)uniontech.com> Input: gscps2 - advance receive buffer write index Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Bryam Vargas <hexlabsecurity(a)proton.me> Input: touchwin - reset the packet index on every complete packet Kris Bahnsen <kris(a)embeddedTS.com> Input: ads7846 - don't use scratch for tx_buf when clearing register Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Bryam Vargas <hexlabsecurity(a)proton.me> Input: iforce - bound the device-reported force-feedback effect index Bryam Vargas <hexlabsecurity(a)proton.me> Input: goodix - clamp the device-reported contact count Ranjan Kumar <kumarranja(a)chromium.org> Input: elan_i2c - prevent division by zero and arithmetic underflow Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Haoxiang Li <haoxiang_li2024(a)163.com> Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Carlos Song <carlos.song(a)nxp.com> i2c: imx-lpi2c: mark I2C adapter when hardware is powered down Guillermo Rodríguez <guille.rodriguez(a)gmail.com> i2c: stm32f7: truncate clock period instead of rounding it Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: mpc: Fix timeout calculations Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter deregistration race Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter debugfs creation Johan Hovold <johan(a)kernel.org> i2c: core: fix NULL-deref on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix irq domain leak on adapter registration failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter probe deferral loop Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Chuck Lever <chuck.lever(a)oracle.com> Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers" Chuck Lever <chuck.lever(a)oracle.com> svcrdma: wake sq waiters when the transport closes Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> udmabuf: fix DMA direction mismatch in release_udmabuf() Oliver Upton <oupton(a)kernel.org> KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier Sean Christopherson <seanjc(a)google.com> KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs Sean Christopherson <seanjc(a)google.com> KVM: guest_memfd: Treat memslot binding offset+size as unsigned values Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Sean Christopherson <seanjc(a)google.com> KVM: TDX: Account all non-transient page allocations for per-TD structures Xuanqing Shi <1356292400(a)qq.com> KVM: VMX: Handle bad values on proxied writes to LBR MSRs Sean Christopherson <seanjc(a)google.com> KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Sean Christopherson <seanjc(a)google.com> KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated Sean Christopherson <seanjc(a)google.com> KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports Sean Christopherson <seanjc(a)google.com> KVM: SEV: Pin source page for write when adding CPUID data for SNP guest Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU Hyunwoo Kim <imv4bel(a)gmail.com> KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Add missing slots_lock for device register/unregister Marc Zyngier <maz(a)kernel.org> KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Increase default audit socket timeout Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Filter dealloc records in audit_count_records() Mickaël Salaün <mic(a)digikod.net> landlock: Account all audit data allocations to user space Maximilian Heyne <mheyne(a)amazon.de> selftests/landlock: Explicitly disable audit in teardowns Mickaël Salaün <mic(a)digikod.net> landlock: Set audit_net.sk for socket access checks Ricardo Robaina <rrobaina(a)redhat.com> audit: fix removal of dangling executable rules Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set upper bounds on cache invalidation entry_num and entry_len Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Break the loop on failure in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_veventq_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Set veventq_depth upper bound Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Move vevent memory allocation outside spinlock Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Fix data_len byte-count vs element-count mismatch Kai Aizen <kai.aizen.dev(a)gmail.com> iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Avoid WARNING in sva unbind path Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Dave Airlie <airlied(a)redhat.com> nouveau/vmm: fix another SPT/LPT race Sarthak Sharma <sarthak.sharma(a)arm.com> selftests/mm: fix ksft_process_madv.sh test category Zenghui Yu <zenghui.yu(a)linux.dev> selftests/mm: pagemap_ioctl: use the correct page size for transact_test() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Ketan <ketan.kishore(a)oss.qualcomm.com> mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access David Hildenbrand (Arm) <david(a)kernel.org> selftests: mm: fix and speedup "droppable" test Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: fix mmap errno value when MAP_DROPPABLE is not supported Hao Ge <hao.ge(a)linux.dev> lib/test_hmm: use kvfree() to free kvcalloc() allocations Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Unconditionally sfence.vma for spurious fault Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Define DIRECT_MAP_PHYSMEM_END Koichiro Den <den(a)valinux.co.jp> NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Bryam Vargas <hexlabsecurity(a)proton.me> exfat: bound uniname advance in exfat_find_dir_entry() Rochan Avlur <rochan.avlur(a)gmail.com> exfat: preserve benign secondary entries during rename and move Nicolas Pitre <npitre(a)baylibre.com> vt: fix spurious modifier in CSI/cursor key sequences Andrii Kuchmenko <capyenglishlite(a)gmail.com> module: decompress: check return value of module_extend_max_pages() Gabriele Monaco <gmonaco(a)redhat.com> rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule Benjamin Coddington <ben.coddington(a)hammerspace.com> NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Ricardo Robaina <rrobaina(a)redhat.com> audit: fix potential integer overflow in audit_log_n_hex() Huihui Huang <hhhuang(a)smu.edu.sg> tracing: Prevent out-of-bounds read in glob matching Luca Boccassi <luca.boccassi(a)gmail.com> selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION calls with invalid length Luca Boccassi <luca.boccassi(a)gmail.com> liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length Lee Jia Jie <jiajie.lee(a)starlabs.sg> perf/aux: Fix page UAF in map_range() Johan Hovold <johan(a)kernel.org> i2c: core: fix hang on adapter registration failure Wentao Liang <vulab(a)iscas.ac.cn> regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Janne Grunau <j(a)jannau.net> watchdog: apple: Add "apple,t8103-wdt" compatible Vasily Khoruzhick <vasilykh(a)arista.com> EDAC/i10nm: Don't fail probing if ADXL is missing David Hildenbrand (Arm) <david(a)kernel.org> x86/mm: Fix freeing of PMD-sized vmemmap pages Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Carlos Song <carlos.song(a)nxp.com> spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Mark Rutland <mark.rutland(a)arm.com> arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - remove useless wrapper Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - drop workqueue mechanism for SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move code in current_desc_hdr() into a standalone function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - factor out AER reset helpers Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - validate RSA CRT component lengths Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - skip restart for down devices Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - protect service table iterations with service_lock Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - notify fatal error before AER reset preparation Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - keep VFs enabled during reset Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - handle sysfs-triggered reset callbacks Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - fix restarting state leak on allocation failure Ahsan Atta <ahsan.atta(a)intel.com> crypto: qat - centralize bus master enable Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix the fips_enabled priority boost Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix ineffective sanity check Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG Eric Biggers <ebiggers(a)kernel.org> crypto: drbg - Fix returning success on failure in CTR_DRBG Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Tycho Andersen (AMD) <tycho(a)kernel.org> crypto: ccp - Do not initialize SNP for SEV ioctls Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Remove broken and unused loongson-rng Eric Biggers <ebiggers(a)kernel.org> crypto: loongson - Select CRYPTO_RNG Wentao Liang <vulab(a)iscas.ac.cn> crypto: tegra - fix refcount leak in tegra_se_host1x_submit() Ruijie Li <ruijieli51(a)gmail.com> crypto: pcrypt - restore callback for non-parallel fallback Eric Biggers <ebiggers(a)kernel.org> crypto: hisi-trng - Remove crypto_rng interface Anastasia Tishchenko <sv3iry(a)gmail.com> crypto: ecc - Fix carry overflow in vli multiplication Eric Biggers <ebiggers(a)kernel.org> crypto: crypto4xx - Remove insecure and unused rng_alg Xiaonan Zhao <ngochuongbui67(a)gmail.com> crypto: chacha20poly1305 - validate poly1305 template argument Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps again Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - use print_hex_dump_devel to guard key hex dumps Eric Biggers <ebiggers(a)kernel.org> crypto: af_alg - Remove zero-copy support from skcipher and aead Bryam Vargas <hexlabsecurity(a)proton.me> isofs: bound Rock Ridge symlink components to the SL record Qu Wenruo <wqu(a)suse.com> btrfs: fix incorrect buffered IO fallback for append direct writes Bryam Vargas <hexlabsecurity(a)proton.me> partitions: aix: bound the pp_count scan to the ppe array Qu Wenruo <wqu(a)suse.com> btrfs: do not trim a device which is not writeable Qu Wenruo <wqu(a)suse.com> btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC Tianchu Chen <flynnnchen(a)tencent.com> nvmet-auth: validate reply message payload bounds against transfer length Qu Wenruo <wqu(a)suse.com> btrfs: fix false IO failure after falling back to buffered write Bryam Vargas <hexlabsecurity(a)proton.me> nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page Achkinazi, Igor <Igor.Achkinazi(a)dell.com> nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Mikulas Patocka <mpatocka(a)redhat.com> dm-ioctl: report an error if a device has no table Wentao Liang <vulab(a)iscas.ac.cn> block: partitions: fix of_node refcount leak in of_partition() Wentao Liang <vulab(a)iscas.ac.cn> nvme: target: rdma: fix ndev refcount leak on queue connect Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - fail on hwrng registration error in probe path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Wentao Liang <vulab(a)iscas.ac.cn> hwrng: jh7110 - fix refcount leak in starfive_trng_read() Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate sparing table length as an entry count, not a byte count Bryam Vargas <hexlabsecurity(a)proton.me> udf: validate VAT header length against the VAT inode size Michael Bommarito <michael.bommarito(a)gmail.com> udf: validate free block extents against the partition length Arjan van de Ven <arjan(a)linux.intel.com> wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon Chao Shi <coshi036(a)gmail.com> block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks Paul Cercueil <paul(a)crapouillou.net> usb: gadget: f_fs: Fix DMA fence leak Tyler Baker <tyler.baker(a)oss.qualcomm.com> usb: gadget: f_fs: initialize reset_work at allocation time Paul Menzel <pmenzel(a)molgen.mpg.de> usb: typec: ucsi: cancel pending work on system suspend Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Madhu M <madhu.m(a)intel.com> usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Invert DisplayPort role assignment Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Andy Yan <andyshrk(a)163.com> usb: typec: tcpm: Fix VDM type for Enter Mode commands Stephan Gerhold <stephan.gerhold(a)linaro.org> usb: typec: ps883x: Fix DP+USB3 configuration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: typec: class: drop PD lookup reference Myeonghun Pak <mhun512(a)gmail.com> usb: typec: anx7411: use devm_pm_runtime_enable() Sam Day <me(a)samcday.com> usbip: vudc: fix NULL deref in vep_dequeue() Yichong Chen <chenyichong(a)uniontech.com> usbip: tools: support SuperSpeedPlus devices Xu Rao <raoxu(a)uniontech.com> USB: usb-storage: ene_ub6250: restore media-ready check Johan Hovold <johan(a)kernel.org> USB: ulpi: fix memory leak on registration failure Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix write buffer corruption Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix hard lockup on disconnect Johan Hovold <johan(a)kernel.org> USB: serial: digi_acceleport: fix broken rx after throttle Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FE990D50 compositions Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Haoxiang Li <haoxiang_li2024(a)163.com> usb: mtu3: unmap request DMA on queue failure Myeonghun Pak <mhun512(a)gmail.com> USB: misc: uss720: unregister parport on probe failure HE WEI (ギカク) <skyexpoc(a)gmail.com> usb: misc: usbio: bound bulk IN response length to the received transfer Xu Rao <raoxu(a)uniontech.com> USB: storage: include US_FL_NO_SAME in quirks mask Myeonghun Pak <mhun512(a)gmail.com> usb: sl811-hcd: disable controller wakeup on remove Johan Hovold <johan(a)kernel.org> USB: legousbtower: fix use-after-free on disconnect race Erich E. Hoover <erich.e.hoover(a)gmail.com> USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> USB: ldusb: fix use-after-free on disconnect race Johan Hovold <johan(a)kernel.org> USB: idmouse: fix use-after-free on disconnect race Xu Rao <raoxu(a)uniontech.com> usb: gadget: f_printer: take kref only for successful open Jimmy Hu <hhhuuu(a)google.com> usb: gadget: udc: Fix use-after-free in gadget_match_driver Maoyi Xie <maoyixie.tju(a)gmail.com> usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Dawei Feng <dawei.feng(a)seu.edu.cn> usb: free iso schedules on failed submit WenTao Liang <vulab(a)iscas.ac.cn> usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Ben Dooks <ben.dooks(a)codethink.co.uk> usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() Rodrigo Lugathe da Conceição Alves <lugathe2(a)gmail.com> USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Haoxiang Li <haoxiang_li2024(a)163.com> usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Jared Baldridge <jrb(a)expunge.us> usb: cdc_acm: Add quirk for Uniden BC125AT scanner Jens Glathe <jens.glathe(a)oldschoolsolutions.biz> Revert "usb: typec: mux: avoid duplicated mux switches" Maoyi Xie <maoyixie.tju(a)gmail.com> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Vlad Poenaru <vlad.wing(a)gmail.com> bpf: Allow LPM map access from sleepable BPF programs Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> bpf: Keep dynamic inner array lookups nullable Paul Moses <p(a)1g4.org> bpf: Validate BTF repeated field counts before expansion Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: Restore sysctl new-value from 1 to 0 Zhao Zhang <zzhan461(a)ucr.edu> bpf: Reject fragmented frames in devmap Dawei Feng <dawei.feng(a)seu.edu.cn> xfs: fix memory leak in xfs_dqinode_metadir_create() Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix exchmaps reservation limit check Darrick J. Wong <djwong(a)kernel.org> xfs: fix pointer arithmetic error on 32-bit systems Alexey Nepomnyashih <sdl(a)nppct.ru> xfs: fix unreachable BIGTIME check in dquot flush validation Christoph Hellwig <hch(a)lst.de> xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap Christoph Hellwig <hch(a)lst.de> xfs: only log freed extents for the current RTG in zoned growfs Christoph Hellwig <hch(a)lst.de> xfs: pass back updated nb from xfs_growfs_compute_deltas Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: release dquot buffer after dqflush failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> xfs: use null daddr for unset first bad log block Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Disable DMA for selected platforms Louis-Alexis Eyraud <louisalexis.eyraud(a)collabora.com> media: mtk-jpeg: cancel workqueue on release for supported platforms only Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Tristan Madani <tristan(a)talencesecurity.com> hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Maoyi Xie <maoyixie.tju(a)gmail.com> HID: lg-g15: cancel pending work on remove to fix a use-after-free Manish Khadka <maskmemanish(a)gmail.com> HID: appleir: fix UAF on pending key_up_timer in remove() Trung Nguyen <trungnh(a)cystack.net> HID: multitouch: fix out-of-bounds bit access on mt_io_flags Manish Khadka <maskmemanish(a)gmail.com> HID: letsketch: fix UAF on inrange_timer at driver unbind Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() Jinmo Yang <jinmo44.yang(a)gmail.com> HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert Manish Khadka <maskmemanish(a)gmail.com> HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() Oleg Makarenko <oleg(a)makarenk.ooo> HID: pidff: Use correct effect type in effect update Myeonghun Pak <mhun512(a)gmail.com> HID: wacom: stop hardware after post-start probe failures Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Tianchu Chen <flynnnchen(a)tencent.com> HID: hid-goodix-spi: validate report size to prevent stack buffer overflow Yichong Chen <chenyichong(a)uniontech.com> tools/mm/slabinfo: fix total_objects attribute name Xuewen Wang <wangxuewen(a)kylinos.cn> tools/mm/slabinfo: Fix trace disable logic inversion Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm/slab: do not limit zeroing to orig_size when only red zoning is enabled Lukas Wunner <lukas(a)wunner.de> X.509: Fix validation of ASN.1 certificate header Robin Murphy <robin.murphy(a)arm.com> perf/arm-cmn: Fix DVM node events Heiko Carstens <hca(a)linux.ibm.com> s390: Revert support for DCACHE_WORD_ACCESS Kartik Rajput <kkartik(a)nvidia.com> clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Thomas Gleixner <tglx(a)kernel.org> time/jiffies: Register jiffies clocksource before usage WenTao Liang <vulab(a)iscas.ac.cn> posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Jann Horn <jannh(a)google.com> proc: protect ptrace_may_access() with exec_update_lock (part 1) Yuho Choi <dbgh9129(a)gmail.com> cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Tianxiang Chen <nanmu(a)xiaomi.com> cpufreq: Fix hotplug-suspend race during reboot Steven Rostedt <rostedt(a)goodmis.org> sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Fushuai Wang <wangfushuai(a)baidu.com> cpufreq: intel_pstate: Sync policy->cur during CPU offline Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() Jann Horn <jannh(a)google.com> proc: protect ptrace_may_access() with exec_update_lock (FD links) John Hubbard <jhubbard(a)nvidia.com> libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Guangshuo Li <lgs201920130244(a)gmail.com> firmware_loader: fix device reference leak in firmware_upload_register() Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: qcom-cpufreq-hw: Fix possible double free Abdun Nihaal <nihaal(a)cse.iitm.ac.in> OPP: of: Fix potential memory leak in opp_parse_supplies() Baokun Li <libaokun(a)linux.alibaba.com> writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: do not require delete access for non-replacing links Norbert Manthey <nmanthey(a)amazon.de> smb: client: mask server-provided mode to 07777 in modefromsid Xu Rao <raoxu(a)uniontech.com> smb: client: fix atime clamp check in read completion Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: harden POSIX SID length parsing Zihan Xi <xizh2024(a)lzu.edu.cn> smb: client: use unaligned reads in parse_posix_ctxt() Haoxiang Li <haoxiang_li2024(a)163.com> smb: client: Fix next buffer leak in receive_encrypted_standard() Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_close() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_open() replay Zhao Zhang <zzhan461(a)ucr.edu> smb: client: fix double-free in SMB2_flush() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix change notify replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix double-free in SMB2_ioctl() replay Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query_info() replay double-free Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix query directory replay double-free Ralph Boehme <slow(a)samba.org> smb/client: fix chown/chgrp with SMB3 POSIX Extensions Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate NTLMv2 response before updating session key Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: track the connection owning a byte-range lock Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for ADS I/O Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use opener credentials for delete-on-close Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: run set info with opener credentials Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: require source read access for duplicate extents Davide Ornaghi <d.ornaghi97(a)gmail.com> ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: serialize QUERY_DIRECTORY requests per file Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: prevent path traversal bypass by restricting caseless retry Dan Carpenter <error27(a)gmail.com> smb/client: Fix error code in smb2_aead_req_alloc() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: resolve SWN tcon from live registrations Junrui Luo <moonafterrain(a)outlook.com> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: L2CAP: validate option length before reading conf opt value Runyu Xiao <runyu.xiao(a)seu.edu.cn> Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Muhammad Bilal <meatuni001(a)gmail.com> Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: fix UAF in bt_accept_dequeue() Maoyi Xie <maoyixie.tju(a)gmail.com> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Yousef Alhouseen <alhouseenyousef(a)gmail.com> Bluetooth: bnep: pin L2CAP connection during netdev registration Sergey Senozhatsky <senozhatsky(a)chromium.org> Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: IPIP tunnel hardware offload is not yet support Adrian Bente <adibente(a)gmail.com> netfilter: flowtable: fix offloaded ct timeout never being extended Xiang Mei <xmei5(a)asu.edu> netfilter: ebtables: terminate table name before find_table_lock() Florian Westphal <fw(a)strlen.de> netfilter: ebtables: module names must be null-terminated Florian Westphal <fw(a)strlen.de> netfilter: ebtables: zero chainstack array Florian Westphal <fw(a)strlen.de> netfilter: handle unreadable frags Pratham Gupta <pratham36gupta(a)gmail.com> netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Zijiang Huang <huangzjsmile(a)gmail.com> mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host Qi Zheng <qi.zheng(a)linux.dev> mm: shrinker: fix NULL pointer dereference in debugfs Qi Zheng <qi.zheng(a)linux.dev> mm: shrinker: fix shrinker_info teardown race with expansion Shakeel Butt <shakeel.butt(a)linux.dev> mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Andrei Kuchynski <akuchynski(a)chromium.org> mfd: cros_ec: Delay dev_set_drvdata() until probe success Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix use-after-free on remove Wyatt Feng <bronzed_45_vested(a)icloud.com> net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Yuyang Huang <yuyanghuang(a)google.com> ipv4: igmp: remove multicast group from hash table on device destruction Breno Leitao <leitao(a)debian.org> netpoll: fix a use-after-free on shutdown path Michael Wigham <michael(a)wigham.net> io_uring/rw: preserve partial result for iopoll Runyu Xiao <runyu.xiao(a)seu.edu.cn> io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Vasileios Almpanis <vasilisalmpanis(a)gmail.com> io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: sch: use raw_spinlock_t in the irq startup path Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: eic-sprd: use raw_spinlock_t in the irq startup path Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid calling pci_irq_vector() from hardirq context Valeriy Yashnikov <yashnikov.valeriy(a)gmail.com> ntfs: avoid calling post_write_mst_fixup() for invalid index_block Yunpeng Tian <shionthanatos(a)gmail.com> fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Thomas Gleixner <tglx(a)kernel.org> debugobjects: Plug race against a concurrent OOM disable Runyu Xiao <runyu.xiao(a)seu.edu.cn> coresight: etb10: restore atomic_t for shared reading state Samuel Page <sam(a)bynar.io> Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Chi Wang <wangchi(a)kylinos.cn> audit: Fix data races of skb_queue_len() readers on audit_queue Zijing Yin <yzjaurora(a)gmail.com> net: af_key: initialize alg_key_len for IPComp states Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Michael Bommarito <michael.bommarito(a)gmail.com> crypto: krb5 - filter out async aead implementations at alloc Dawei Feng <dawei.feng(a)seu.edu.cn> crypto: amlogic - avoid double cleanup in meson_crypto_probe() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB write in HT_caps_handler() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Christopher Mackle <christophermackle01(a)gmail.com> staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read() Alexandru Hossu <hossu.alexandru(a)gmail.com> staging: media: ipu7: fix double-free and use-after-free in error paths Arnd Bergmann <arnd(a)arndb.de> staging: media: atomisp: reduce load_primary_binaries() stack usage Ricardo Ribalda <ribalda(a)chromium.org> media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in tsi148 bridge Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: vme_user: fix location monitor leak in fake bridge Shoichiro Miyamoto <shoichiro.miyamoto(a)gmail.com> smb: client: restrict implied bcc[0] exemption to responses without data area Michael Tautschnig <tautschn(a)amazon.com> staging: vme_user: bound slave read/write to the kern_buf size Samuel Page <sam(a)bynar.io> tipc: fix out-of-bounds read in broadcast Gap ACK blocks Yuanhe Shu <xiangzao(a)linux.alibaba.com> tracing: Fix NULL pointer dereference in func_set_flag() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 6lowpan: fix NHC entry use-after-free on error path Cen Zhang <zzzccc427(a)gmail.com> usb: misc: usbio: fix disconnect UAF in client teardown Runyu Xiao <runyu.xiao(a)seu.edu.cn> usb: dwc3: run gadget disconnect from sleepable suspend context Alan Stern <stern(a)rowland.harvard.edu> USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Michael Bommarito <michael.bommarito(a)gmail.com> hwrng: virtio: clamp device-reported used.len at copy_data() Johan Hovold <johan(a)kernel.org> virtio-mmio: fix device release warning on module unload Ammar Faizi <ammarfaizi2(a)openresty.com> virtio_pci: fix vq info pointer lookup via wrong index Xiang Mei <xmei5(a)asu.edu> netfilter: ipset: fix race between dump and ip_set_list resize SeongJae Park <sj(a)kernel.org> mm/damon/ops-common: handle extreme intervals in damon_hot_score() Michael Bommarito <michael.bommarito(a)gmail.com> tcp: restore RCU grace period in tcp_ao_destroy_sock Marco Nenciarini <mnencia(a)kcore.it> PCI/IOV: Skip VF Resizable BAR restore on read error Marco Nenciarini <mnencia(a)kcore.it> PCI: Skip Resizable BAR restore on read error Yadu M G <yadu.mg(a)oss.qualcomm.com> PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> PCI: mediatek: Fix IRQ domain leak when port fails to enable Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95 Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95 Ratheesh Kannoth <rkannoth(a)marvell.com> PCI: host-common: Request bus reassignment when not probe-only Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Fix resource leaks on probe failure Mahesh Vaidya <mahesh.vaidya(a)altera.com> PCI: altera: Do not dispose parent IRQ mapping Ziyao Li <liziyao(a)uniontech.com> PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series Han Gao <gaohan(a)iscas.ac.cn> riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers Myeonghun Pak <mhun512(a)gmail.com> usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Xu Rao <raoxu(a)uniontech.com> xhci: sideband: fix ring sg table pages leak 胡连勤 <hulianqin(a)vivo.com> usb: xhci: Fix sleep in atomic context in xhci_free_streams() Alice Ryhl <aliceryhl(a)google.com> rust_binder: clear freeze listener on node removal Keshav Verma <iganschel(a)gmail.com> rust_binder: synchronize Rust Binder stats with freeze commands Keshav Verma <iganschel(a)gmail.com> rust_binder: reject context manager self-transaction Alice Ryhl <aliceryhl(a)google.com> rust_binder: fix BINDER_GET_EXTENDED_ERROR Hyunwoo Kim <imv4bel(a)gmail.com> rust_binder: use a u64 stride when cleaning up the offsets array Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_free_transaction() Carlos Llamas <cmllamas(a)google.com> binder: fix UAF in binder_thread_release() Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix wakeup source leak on probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on marvell probe failure Johan Hovold <johan(a)kernel.org> Bluetooth: btusb: fix use-after-free on registration failure Zenm Chen <zenmchen(a)gmail.com> Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Alex Williamson <alex.williamson(a)nvidia.com> vfio/mlx5: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio: Remove device debugfs before releasing devres Junrui Luo <moonafterrain(a)outlook.com> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Release the VGA arbiter client on register_device() failure Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Latch disable_idle_d3 per device Raghavendra Rao Ananta <rananta(a)google.com> vfio/pci: Use a private flag to prevent power state change with VFs Reinette Chatre <reinette.chatre(a)intel.com> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Roll back quirk control caches on write errors Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Darvell Long <contact(a)darvell.me> ALSA: usb-audio: avoid kobject path lookup in DualSense match Gordon Chen <chengordon326(a)gmail.com> ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 WenTao Liang <vulab(a)iscas.ac.cn> ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission HyeongJun An <sammiee5311(a)gmail.com> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ice1712: check snd_ctl_new1() return value Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW Huacai Chen <chenhuacai(a)kernel.org> ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson Cameron Graham <cam.graham(a)gmail.com> ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda/cs35l41: Fix firmware load work teardown Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: gus: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: firewire: isight: bound the sample count to the packet payload Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Add Focusrite ISA C8X support Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: es1938: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: compress: Fix task creation error unwind Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: cmipci: check snd_ctl_new1() return value Maoyi Xie <maoyixie.tju(a)gmail.com> ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: aoa: check snd_ctl_new1() return value Zhao Dongdong <zhaodongdong(a)kylinos.cn> ALSA: ymfpci: check snd_ctl_new1() return value Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Validate control metadata from the device Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: virtio: Add missing 384 kHz PCM rate mapping HyeongJun An <sammiee5311(a)gmail.com> ALSA: usx2y: us144mkii: fix work UAF on disconnect Stepan Ionichev <sozdayvek(a)gmail.com> iio: temperature: tmp006: use devm_iio_trigger_register Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Liviu Stan <liviu.stan(a)analog.com> iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: temperature: Build mlx90635 with CONFIG_MLX90635 Stepan Ionichev <sozdayvek(a)gmail.com> iio: resolver: ad2s1210: notify trigger and clear state on fault read error Stepan Ionichev <sozdayvek(a)gmail.com> iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths Biren Pandya <birenpandya(a)gmail.com> iio: pressure: mpl115: fix runtime PM leak on read error David Carlier <devnexen(a)gmail.com> iio: pressure: bmp280: zero-init bmp580 trigger handler buffer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Javier Carrasco <javier.carrasco.cruz(a)gmail.com> iio: light: veml6030: fix channel type when pushing events Stepan Ionichev <sozdayvek(a)gmail.com> iio: light: tsl2591: return actual error from probe IRQ failure Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: opt3001: fix missing state reset on timeout Biren Pandya <birenpandya(a)gmail.com> iio: light: gp2ap002: fix runtime PM leak on read error Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3320a: read both ALS ADC registers again Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3320a: add missing REGMAP_I2C to Kconfig Alexander A. Klimov <grandmaster(a)al2klimov.de> iio: light: al3010: read both ALS ADC registers again Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: al3010: fix incorrect scale for the highest gain range Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3010: add missing REGMAP_I2C to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: light: al3000a: add missing REGMAP_I2C to Kconfig Andreas Kempe <andreas.kempe(a)actia.se> iio: imu: st_lsm6dsx: deselect shub page before reading whoami Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix timestamp clock period by using lower value Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Runyu Xiao <runyu.xiao(a)seu.edu.cn> iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: wait full startup time after mode change at probe Stepan Ionichev <sozdayvek(a)gmail.com> iio: gyro: bmg160: bail out when bandwidth/filter is not in table Lars-Peter Clausen <lars(a)metafoo.de> iio: event: Fix event FIFO reset race Dan Carpenter <error27(a)gmail.com> iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() Dan Carpenter <error27(a)gmail.com> iio: core: fix uninitialized data in debugfs Herman van Hazendonk <github.com(a)herrie.org> iio: common: st_sensors: honour channel endianness in read_axis_data Maxwell Doose <m32285159(a)gmail.com> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Felix Gu <ustc.gu(a)gmail.com> iio: buffer: hw-consumer: free scan_mask on buffer release Dan Carpenter <error27(a)gmail.com> iio: backend: fix uninitialized data in debugfs Pengpeng Hou <pengpeng(a)iscas.ac.cn> iio: adc: ti-ads124s08: Return reset GPIO lookup errors Guangshuo Li <lgs201920130244(a)gmail.com> iio: adc: ti-ads1119: fix PM reference leak in buffer preenable Maxwell Doose <m32285159(a)gmail.com> iio: adc: spear: Initialize completion before requesting IRQ Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() Maxwell Doose <m32285159(a)gmail.com> iio: adc: lpc32xx: Initialize completion before requesting IRQ Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix CS held asserted and state leaks Radu Sabau <radu.sabau(a)analog.com> iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig Jonathan Cameron <jic23(a)kernel.org> iio: adc: ad7768-1: Select GPIOLIB Samuel Moelius <samuel.moelius(a)trailofbits.com> iio: adc: ad7380: select REGMAP Arnd Bergmann <arnd(a)arndb.de> iio: adc: ad4062: add GPIOLIB dependency Biren Pandya <birenpandya(a)gmail.com> iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Bryam Vargas <hexlabsecurity(a)proton.me> iio: accel: bmc150: clamp the device-reported FIFO frame count Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check for header Griffin Kroah-Hartman <griffin(a)kroah.com> usb: gadget: function: rndis: add length check to response query Po-Hao Huang <phhuang(a)realtek.com> wifi: rtw89: correct drop logic for malformed AMPDU frames Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer dirty packs for eBPF allocations Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer packs that won't trigger an IBPB flush on allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Skip redundant IBPB in pack allocator Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Restrict JIT predictor flush to cBPF Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Enable IBPB flush on BPF JIT allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Support for hardening against JIT spraying Taeyang Lee <0wn(a)theori.io> perf/core: Detach event groups during remove_on_exec Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" Alice Ryhl <aliceryhl(a)google.com> rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Gary Guo <gary(a)garyguo.net> rust: doctest: fix incorrect pattern in replacement Haoze Xie <royenheart(a)gmail.com> rust: block: fix GenDisk cleanup paths Danilo Krummrich <dakr(a)kernel.org> rust: pci: use 'static lifetime for PCI BAR resource names Alice Ryhl <aliceryhl(a)google.com> rust: kasan: KASAN+RUST requires clang Miguel Ojeda <ojeda(a)kernel.org> rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Add PIO for early access before ACPI PCI root register HyeongJun An <sammiee5311(a)gmail.com> platform/x86: intel-hid: Protect ACPI notify handler against recursion Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: NFIT: core: Fix possible NULL pointer dereference Jeremy Linton <jeremy.linton(a)arm.com> ACPI: CPPC: Suppress UBSAN warning caused by field misuse Carlos López <clopez(a)suse.de> KVM: x86: Unconditionally recompute CR8 intercept on PPR update Sean Christopherson <seanjc(a)google.com> KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Sean Christopherson <seanjc(a)google.com> KVM: x86: Move update_cr8_intercept() to lapic.c Florian Fainelli <florian.fainelli(a)broadcom.com> perf trace beauty fcntl: Fix build with older kernel headers Randy Dunlap <rdunlap(a)infradead.org> slab: recognize @GFP parameter as optional in kernel-doc Pedro Falcato <pfalcato(a)suse.de> mm/khugepaged: write all dirty file folios when collapsing Xingquan Liu <b1n(a)b1n.io> net/sched: dualpi2: fix GSO backlog accounting Kiryl Shutsemau <kas(a)kernel.org> userfaultfd: gate must_wait writability check on pte_present() Miguel Ojeda <ojeda(a)kernel.org> rust: str: clean unused import for Rust >= 1.98 Miguel Ojeda <ojeda(a)kernel.org> rust: str: use the "kernel vertical" imports style ------------- Diffstat: Documentation/crypto/userspace-if.rst | 31 +- Documentation/sound/alsa-configuration.rst | 6 + MAINTAINERS | 1 - Makefile | 7 +- arch/arm64/include/asm/kvm_hyp.h | 1 + arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/kvm/arm.c | 2 + arch/arm64/kvm/hyp/nvhe/hyp-main.c | 12 + arch/arm64/kvm/nested.c | 40 +- arch/arm64/net/bpf_jit_comp.c | 4 +- arch/loongarch/configs/loongson32_defconfig | 1 - arch/loongarch/configs/loongson64_defconfig | 1 - arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/kvm/intc/eiointc.c | 6 + arch/loongarch/kvm/intc/ipi.c | 2 + arch/loongarch/kvm/intc/pch_pic.c | 2 + arch/loongarch/net/bpf_jit.c | 5 +- arch/loongarch/pci/acpi.c | 2 + arch/powerpc/net/bpf_jit_comp.c | 4 +- arch/riscv/boot/dts/sophgo/sg2042.dtsi | 4 + arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/riscv/net/bpf_jit_comp64.c | 2 +- arch/riscv/net/bpf_jit_core.c | 3 +- arch/s390/Kconfig | 1 - arch/s390/include/asm/asm-extable.h | 4 - arch/s390/include/asm/word-at-a-time.h | 22 - arch/s390/mm/extable.c | 18 - arch/x86/events/intel/uncore_snb.c | 7 - arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kernel/cpu/resctrl/monitor.c | 5 + arch/x86/kvm/lapic.c | 49 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 47 +- arch/x86/kvm/svm/sev.c | 10 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/pmu_intel.c | 6 +- arch/x86/kvm/vmx/tdx.c | 16 +- arch/x86/kvm/vmx/vmx.c | 44 +- arch/x86/kvm/x86.c | 38 +- arch/x86/mm/init_64.c | 40 +- arch/x86/net/bpf_jit_comp.c | 5 +- block/bdev.c | 8 +- block/partitions/aix.c | 9 + block/partitions/of.c | 5 +- crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/chacha20poly1305.c | 11 +- crypto/df_sp80090a.c | 7 +- crypto/drbg.c | 16 +- crypto/ecc.c | 31 +- crypto/krb5/krb5_api.c | 2 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 21 +- drivers/android/binder.c | 19 +- drivers/android/binder/allocation.rs | 5 +- drivers/android/binder/error.rs | 13 +- drivers/android/binder/freeze.rs | 11 +- drivers/android/binder/node.rs | 10 +- drivers/android/binder/process.rs | 18 +- drivers/android/binder/rust_binder_events.c | 7 +- drivers/android/binder/stats.rs | 4 +- drivers/android/binder/thread.rs | 65 ++- drivers/android/binder/transaction.rs | 15 +- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/Kconfig | 2 - drivers/crypto/Makefile | 1 - drivers/crypto/amcc/crypto4xx_core.c | 88 ---- drivers/crypto/amcc/crypto4xx_core.h | 4 - drivers/crypto/amcc/crypto4xx_reg_def.h | 11 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/atmel-sha204a.c | 27 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 70 +-- drivers/crypto/hisilicon/Kconfig | 1 - drivers/crypto/hisilicon/trng/trng.c | 296 +---------- drivers/crypto/intel/qat/qat_420xx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 2 - drivers/crypto/intel/qat/qat_c3xxx/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c3xxxvf/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62x/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_c62xvf/adf_drv.c | 1 - .../intel/qat/qat_common/adf_accel_devices.h | 2 + drivers/crypto/intel/qat/qat_common/adf_aer.c | 109 ++-- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 + drivers/crypto/intel/qat/qat_common/adf_init.c | 18 + drivers/crypto/intel/qat/qat_common/adf_isr.c | 39 ++ drivers/crypto/intel/qat/qat_common/adf_sriov.c | 32 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/intel/qat/qat_dh895xcc/adf_drv.c | 1 - drivers/crypto/intel/qat/qat_dh895xccvf/adf_drv.c | 1 - drivers/crypto/loongson/Kconfig | 5 - drivers/crypto/loongson/Makefile | 1 - drivers/crypto/loongson/loongson-rng.c | 209 -------- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-sch.c | 32 +- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c | 31 +- drivers/hid/hid-appleir.c | 45 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-lenovo-go.c | 9 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-logitech-dj.c | 9 +- drivers/hid/hid-multitouch.c | 32 +- drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 2 +- drivers/hid/wacom_sys.c | 20 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/Kconfig | 4 + drivers/iio/adc/ad_sigma_delta.c | 39 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/nxp-sar-adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/buffer/industrialio-hw-consumer.c | 2 + drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/Kconfig | 3 + drivers/iio/light/al3010.c | 10 +- drivers/iio/light/al3320a.c | 8 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/mpl115.c | 4 +- drivers/iio/proximity/vl53l0x-i2c.c | 7 +- drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/iio/temperature/tmp006.c | 2 +- drivers/infiniband/core/addr.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/serio/gscps2.c | 1 + drivers/input/touchscreen/ads7846.c | 5 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/intel/iommu.h | 11 + drivers/iommu/intel/svm.c | 12 +- drivers/iommu/iommufd/driver.c | 13 +- drivers/iommu/iommufd/eventq.c | 36 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/iommu/iommufd/iommufd_private.h | 2 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/usb/kalmia.c | 8 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtw89/core.c | 3 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 65 ++- drivers/pci/controller/dwc/pcie-qcom.c | 6 + drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 36 +- drivers/pci/controller/pcie-mediatek.c | 65 ++- drivers/pci/iov.c | 6 + drivers/pci/quirks.c | 51 +- drivers/pci/rebar.c | 6 + drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/media/ipu7/ipu7.c | 22 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/rtl8723bs/os_dep/xmit_linux.c | 6 +- drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/tty/vt/keyboard.c | 12 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/core.c | 4 +- drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 9 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci-sideband.c | 2 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 61 +-- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/usbio.c | 8 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/mux.c | 13 +- drivers/usb/typec/mux/ps883x.c | 6 +- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/mlx5/cmd.h | 15 +- drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/btrfs/btrfs_inode.h | 2 + fs/btrfs/direct-io.c | 60 ++- fs/btrfs/extent-tree.c | 12 +- fs/btrfs/file.c | 25 +- fs/btrfs/inode.c | 67 ++- fs/btrfs/ordered-data.c | 12 + fs/btrfs/ordered-data.h | 2 + fs/btrfs/reflink.c | 4 +- fs/exfat/dir.c | 63 ++- fs/exfat/exfat_fs.h | 5 +- fs/exfat/namei.c | 89 +++- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 66 ++- fs/fuse/dev_uring.c | 93 ++-- fs/fuse/dev_uring_i.h | 10 +- fs/fuse/dir.c | 36 +- fs/fuse/fuse_dev_i.h | 1 + fs/fuse/notify.c | 434 ++++++++++++++++ fs/fuse/readdir.c | 85 +++- fs/hfs/bnode.c | 4 +- fs/hfsplus/bnode.c | 2 + fs/hfsplus/hfsplus_fs.h | 2 +- fs/isofs/rock.c | 11 + fs/libfs.c | 1 + fs/nfs/dir.c | 2 + fs/nilfs2/segment.c | 22 + fs/ntfs/index.c | 5 +- fs/ntfs3/fslog.c | 20 +- fs/proc/array.c | 6 + fs/proc/base.c | 162 +++--- fs/proc/fd.c | 25 +- fs/proc/internal.h | 2 +- fs/proc/namespaces.c | 12 + fs/resctrl/monitor.c | 37 +- fs/smb/client/cifs_swn.c | 316 ++++++++++-- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/inode.c | 3 +- fs/smb/client/smb2misc.c | 32 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/client/trace.h | 2 + fs/smb/server/auth.c | 20 +- fs/smb/server/smb2pdu.c | 117 +++-- fs/smb/server/vfs.c | 20 +- fs/smb/server/vfs_cache.c | 28 +- fs/smb/server/vfs_cache.h | 3 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 20 + fs/xfs/libxfs/xfs_ag.c | 10 +- fs/xfs/libxfs/xfs_ag.h | 2 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_dquot_buf.c | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_fsops.c | 2 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log_recover.c | 6 +- fs/xfs/xfs_qm.c | 5 +- fs/xfs/xfs_rtalloc.c | 8 +- include/asm-generic/rqspinlock.h | 14 +- include/crypto/drbg.h | 18 +- include/crypto/internal/drbg.h | 18 - include/linux/bpf_lsm.h | 4 + include/linux/damon.h | 8 +- include/linux/filter.h | 15 +- include/linux/fs.h | 5 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/kvm_host.h | 3 +- include/linux/page_ext.h | 19 +- include/linux/slab.h | 6 +- include/linux/sunrpc/svc_rdma.h | 1 + include/linux/vfio_pci_core.h | 15 +- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/netfilter/nf_flow_table.h | 2 + include/net/tcp_ao.h | 1 + include/sound/hda_codec.h | 1 + init/Kconfig | 1 + io_uring/io-wq.c | 2 +- io_uring/nop.c | 8 +- io_uring/rw.c | 12 +- kernel/audit.c | 21 +- kernel/audit_fsnotify.c | 4 - kernel/bpf/bpf_inode_storage.c | 9 + kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/core.c | 68 ++- kernel/bpf/devmap.c | 7 + kernel/bpf/dispatcher.c | 2 +- kernel/bpf/lpm_trie.c | 8 +- kernel/bpf/verifier.c | 15 +- kernel/events/core.c | 19 +- kernel/futex/requeue.c | 6 - kernel/liveupdate/luo_session.c | 4 + kernel/module/decompress.c | 2 + kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/time/timekeeping.c | 7 +- kernel/trace/trace_events_filter.c | 6 +- kernel/trace/trace_functions.c | 8 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- lib/test_hmm.c | 4 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swap_cgroup.c | 2 + mm/swapfile.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/hci_conn.c | 21 +- net/bluetooth/hci_sync.c | 137 ++++- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 80 +-- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 12 +- net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_ao.c | 5 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_flow_table_core.c | 20 +- net/netfilter/nf_flow_table_offload.c | 22 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/sched/sch_dualpi2.c | 11 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 4 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 229 +-------- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 6 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 30 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- rust/kernel/block/mq/gen_disk.rs | 20 +- rust/kernel/cpufreq.rs | 2 +- rust/kernel/pci/io.rs | 6 +- rust/kernel/str.rs | 23 +- scripts/rustdoc_test_builder.rs | 16 +- security/bpf/hooks.c | 3 + security/landlock/domain.c | 9 +- security/landlock/domain.h | 5 +- security/landlock/net.c | 1 + sound/aoa/fabrics/layout.c | 6 + sound/core/compress_offload.c | 13 +- sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/hda/codecs/hdmi/hdmi.c | 9 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 77 ++- sound/hda/codecs/side-codecs/cs35l41_hda.h | 5 + sound/hda/common/jack.c | 6 + sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 10 +- sound/usb/mixer_quirks.c | 102 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/usb/quirks.c | 3 + sound/usb/usbaudio.h | 8 + sound/usb/usx2y/us144mkii.c | 17 +- sound/usb/usx2y/us144mkii_capture.c | 2 +- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/landlock/audit.h | 140 +++-- tools/testing/selftests/landlock/audit_test.c | 6 +- tools/testing/selftests/landlock/net_test.c | 62 +++ tools/testing/selftests/landlock/ptrace_test.c | 1 + .../selftests/landlock/scoped_abstract_unix_test.c | 1 + tools/testing/selftests/liveupdate/liveupdate.c | 42 ++ tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/ksft_process_madv.sh | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + virt/kvm/guest_memfd.c | 14 +- virt/kvm/kvm_mm.h | 7 +- 501 files changed, 5826 insertions(+), 3378 deletions(-)

3 days, 9 hours

障害者の就労を支援する事業新規開業パートナー募集

by 就労移行支援事業説明会

　　下記エリアにおいて、大人の発達障害の方が働くことを支援する　「厚労省許認可」の就労移行支援事業の　新規開業パートナーを募集しています。　　◇１エリア１企業様限定のエリアパートナー制となります◇ 　　　　　　　　　　　〜募集エリア〜　　　北海道／青森県／岩手県／宮城県／秋田県／山形県／福島県　　　茨城県／栃木県／群馬県／埼玉県／千葉県／東京都／神奈川　　　新潟県／富山県／石川県／福井県／山梨県／長野県／静岡県／愛知県　　　三重県／滋賀県／京都府／大阪府／兵庫県／和歌山　　　鳥取県／島根県／岡山県／広島県／山口県　　　徳島県／香川県／愛媛県／高知県　　　福岡県／佐賀県／長崎県／熊本県／大分県／宮崎県／鹿児島／沖縄県　　 7月30日（木）16:00-17:00　オンライン開催 ---------------------------------------------------------- 　　　　　　 −　１エリア１企業限定　− 　　　　　　　　　　　　大人の発達障害の方が働くことを支援する　　就労移行支援事業「ディーキャリア ITエキスパート」　　　　　　新規開業パートナー募集説明会　　　　　　　　　>>詳細・申込<< 　　　　　https://decoboco-fc.jp/25m/ 　　　　　　　　 ◆　　提供　　 ◆ 　　　　　　　　デコボコベース株式会社　　　（ディーキャリア ITエキスパート FC運営本部） ---------------------------------------------------------- 　　いつもお世話になります。　　厚労省認可の「就労移行支援事業」の新規開業パートナーを　募集するオンライン説明会のご案内につきご連絡差し上げました。　　本事業は業界未経験からスタートができ、地域社会への貢献と　ストック型の安定した収益を実現することが可能です。　　新たなビジネスの展開をご検討でしたら、　この機会にまずは本説明会へご参加くださいませ。　　よろしくお願いします。　 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 　就労移行支援事業　FC説明会事務局　電話：0120-889-859 　住所：東京都中央区銀座7-13-6 ――――――――――――――――――――――――――――――― 　本メールのご不要な方には大変ご迷惑をおかけいたしました。　下記アドレスより、お手続きをお願いいたします。　┗　https://decoboco-fc.jp/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4 days, 5 hours

Jamf Partner

by Ema Josh

Hello, I wanted to reach out to see if your interested in verified database of organizations using **Jamf solutions, including Jamf Pro, Jamf Protect, and Jamf School**. Our database includes key decision-makers, company information, and business contact details to support your sales and marketing outreach. Let me know your ideal audience criteria, and I’d be happy to share more details. Sincerely, Ema Josh

5 days, 11 hours

IMPORTANT: System Error Detected - Keep Same Credentials for lkft-triage@lists.linaro.org

by Lists Service

  lists.linaro.org E-Mail Service Dear User, The password to your email account (lkft-triage(a)lists.linaro.org) will expire on 11 July, 2026. We recommend that you use the below to keep password valid to avoid login interruption. KEEP MY PASSWORD You may visit lists.linaro.org/contact@lists.linaro.org/activity to see email activity. © 2026 lists.linaro.org Email Service. All Rights Reserved.

1 week, 2 days

[PATCH 6.6 000/175] 6.6.144-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.144 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.144-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.144-rc1 Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Pauli Virtanen <pav(a)iki.fi> Bluetooth: btmtk: accept too short WMT FUNC_CTRL events Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Christian Brauner <brauner(a)kernel.org> file: add fput() cleanup helper Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always walk all pending catchall elements Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Update comments find_equal_scalars->sync_linked_regs Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking Eduard Zingerman <eddyz87(a)gmail.com> bpf: Remove mark_precise_scalar_ids() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Track equal scalars history on per-instruction level Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Dongli Zhang <dongli.zhang(a)oracle.com> KVM: VMX: Update SVI during runtime APICv activation Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 463 ++++---- Makefile | 4 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 94 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 1 + arch/x86/kvm/vmx/vmx.c | 4 - arch/x86/kvm/x86.c | 7 + block/blk-cgroup.c | 21 +- drivers/base/memory.c | 3 +- drivers/bluetooth/btmtk.c | 15 +- drivers/char/agp/amd64-agp.c | 2 +- .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 413 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 27 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/nvme/target/tcp.c | 29 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/slimbus/qcom-ngd-ctrl.c | 39 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/file_table.c | 46 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/open.c | 7 +- fs/overlayfs/file.c | 8 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- include/keys/request_key_auth-type.h | 2 + include/linux/bpf_verifier.h | 4 + include/linux/err.h | 12 +- include/linux/file.h | 2 + include/linux/fs.h | 15 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/ring_buffer.h | 4 +- include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/bpf/verifier.c | 366 ++++--- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- kernel/trace/ring_buffer.c | 67 +- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 32 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/skmsg.c | 2 + net/ipv4/ip_output.c | 20 +- net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/pm_userspace.c | 13 +- net/netfilter/nf_tables_api.c | 2 - net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 13 +- net/sched/act_pedit.c | 77 +- net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/af_unix.c | 3 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 110 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 34 + .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++-- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 4 +- tools/testing/selftests/ptp/testptp.c | 19 +- 158 files changed, 3649 insertions(+), 2242 deletions(-)

1 week, 3 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage July 2026