Lkft-triage August 2026

lkft-triage@lists.linaro.org

31 participants
46 discussions

[PATCH 6.12 000/181] 6.12.104-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.104 release. There are 181 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.104-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.104-rc1 Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc Xu Rao <raoxu(a)uniontech.com> thunderbolt: Fix bandwidth group reservation indexing Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix silent truncation in bpf_get_fsverity_digest() Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions Mimi Zohar <zohar(a)linux.ibm.com> ima: Instantiate file_truncate and path_truncate hooks Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't warn when the mount is completed from another user namespace Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent subbuf order change when resizing is disabled Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Mathieu Dubois-Briand <mathieu.dubois-briand(a)bootlin.com> nvmem: layouts: Add fixed-layout driver Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Ensure UDP sockets are bound Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Kees Cook <kees(a)kernel.org> kunit/fortify: Add back "volatile" for sizeof() constants Kees Cook <kees(a)kernel.org> kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR() Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Ashish Kalra <ashish.kalra(a)amd.com> crypto: ccp - Abort doing SEV INIT if SNP INIT fails Michael Roth <michael.roth(a)amd.com> crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length Ashish Kalra <ashish.kalra(a)amd.com> KVM: SVM: Add support to initialize SEV/SNP functionality in KVM Ashish Kalra <ashish.kalra(a)amd.com> crypto: ccp - Add new SEV/SNP platform shutdown API Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Keith Busch <kbusch(a)kernel.org> blk-mq: pop cached request if it is usable Bart Van Assche <bvanassche(a)acm.org> block: Reorder the request allocation code in blk_mq_submit_bio() Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Sun Jian <sun.jian.kdev(a)gmail.com> net: fix skb length accounting after generic XDP frag adjustment Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Doruk Tan Ozturk <doruk(a)0sec.ai> net: usb: ipheth: fix carrier_work UAF on disconnect Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Guillaume Morin <guillaume(a)morinfr.org> swapfile: call cond_resched() before locking si->lock Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: repeat reading in regular mode if continuous reading fails Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: fix direct mapping creation sizes Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Zeng Jingxiang <linuszeng(a)tencent.com> mm/vmscan: wake up flushers conditionally to avoid cgroup OOM Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Clamp negative current limits Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Avoid overflow in maximum power calculation Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Refresh VNIC default ring on queue restart if needed Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Determine and store default RX ring in vnic structure Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: require at least 16 bytes of TX metadata Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Christian Borntraeger <borntraeger(a)linux.ibm.com> vdpa/mlx5: Fix buffer length in create_direct_keys() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jordan Rife <jordan(a)jrife.io> bpf: tcp: Avoid socket skips and repeats during iteration Jordan Rife <jordan(a)jrife.io> bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Jordan Rife <jordan(a)jrife.io> bpf: tcp: Get rid of st_bucket_done Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Matti Vaittinen <mazziesaccount(a)gmail.com> watchdog: bd96801_wdt: Fix timeout for enabled WDG Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: cancel pending PCI reset work on AER recovery Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: keep the health thread stopped during reset Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Satish Kharat <satishkh(a)cisco.com> enic: fix tx_hang_reset use-after-free on device removal Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix speed configuration residue after driver reload Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Daniel Drake <dan(a)reactivated.net> arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Ray Wu <ray.wu(a)amd.com> drm/amd/display: Check for tg ops in dce110_set_avmute Ray Wu <ray.wu(a)amd.com> drm/amd/display: Add AV mute wait frames to dce110_set_avmute Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API ------------- Diffstat: .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/s390/kvm/pci.c | 86 ++++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 12 + block/blk-mq.c | 38 +-- drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/crypto/ccp/sev-dev.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +-- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc4282.c | 20 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/mtd/nand/spi/core.c | 74 ++++-- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 50 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 ++- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/core.c | 24 +- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 - drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 ++++ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/qcom_geni_serial.c | 43 +-- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 3 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 1 + fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psp-sev.h | 3 + include/net/act_api.h | 19 ++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/route.h | 2 + include/net/sch_generic.h | 1 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 85 ++++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 12 +- kernel/trace/trace_events.c | 2 + lib/fortify_kunit.c | 139 +++++----- mm/huge_memory.c | 49 ++-- mm/swapfile.c | 2 +- mm/vmscan.c | 25 +- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 10 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 ++++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 293 +++++++++++++++------ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++--- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++++---- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 +++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 ++- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- net/xdp/xdp_umem.c | 2 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++ sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 174 files changed, 1957 insertions(+), 881 deletions(-)

2 months

[PATCH 6.18 000/250] 6.18.45-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.45 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.45-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.45-rc1 Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: ensure sufficient headroom in xmit path Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: always set route tuple out ifindex Xu Rao <raoxu(a)uniontech.com> thunderbolt: Fix bandwidth group reservation indexing Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix silent truncation in bpf_get_fsverity_digest() Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions Hugh Dickins <hughd(a)google.com> mm/filemap: __filemap_add_folio() restore index before retrying Mimi Zohar <zohar(a)linux.ibm.com> ima: Instantiate file_truncate and path_truncate hooks Tejun Heo <tj(a)kernel.org> sched/psi: Create the psimon kthread outside of cgroup_mutex Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Breno Leitao <leitao(a)debian.org> x86/mce: Set up the polling timer before CMCI discovery Rik van Riel <riel(a)surriel.com> x86/CPU: Add a tlbi= cmdline switch Lorenzo Stoakes (ARM) <ljs(a)kernel.org> arm64: remove redundant concurrent ptdump UAF mitigation Hidayath Khan <hidayath(a)linux.ibm.com> dibs: initialise dibs->lock in dibs_dev_alloc() Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't warn when the mount is completed from another user namespace Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Pavel Begunkov <asml.silence(a)gmail.com> net: devmem: prevent net-iov / page mixing Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Alexandra Winter <wintera(a)linux.ibm.com> net/dibs: Correct freeing of dmb_clientid_arr Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Ahmed Naseef <naseefkm(a)gmail.com> net: phy: mediatek: fix TX blink masks using the RX bits Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Hui Su <sh_def(a)163.com> tracing: Fix NULL pointer dereference in module event cache removal Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent subbuf order change when resizing is disabled Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Maíra Canal <mcanal(a)igalia.com> drm/v3d: Serialize the scheduler timeout handlers Baul Lee <baul.lee(a)xbow.com> ALSA: us144mkii: re-anchor capture URBs on resubmission Xu Rao <raoxu(a)uniontech.com> ALSA: hda/tas2781: fix ACPI reference handling Baul Lee <baul.lee(a)xbow.com> ALSA: FCP: fix OOB write in fcp_meter_ctl_get() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs SJ Park <sj(a)kernel.org> mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} SJ Park <sj(a)kernel.org> samples/damon/mtier: error out for zero quota goal target values liyouhong <liyouhong(a)kylinos.cn> mm/damon/ops-common: putback folios on invalid migrate nid Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: fix indefinite RS485 post-send delay Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Alice Ryhl <aliceryhl(a)google.com> rust_binder: do not query current thread for all ioctls Mathieu Dubois-Briand <mathieu.dubois-briand(a)bootlin.com> nvmem: layouts: Add fixed-layout driver Aelin Reidel <aelin(a)mainlining.org> nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Ensure UDP sockets are bound Nils Helmig <nils.helmig(a)web.de> Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV Alexej Sidorenko <alexej(a)sidorenko.cz> Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> iommu/vt-d: Gather the unmapped range before freeing its page tables Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Keith Busch <kbusch(a)kernel.org> blk-mq: pop cached request if it is usable Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/amd/display: Fix backlight max_brightness to match exported range" Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Philipp David <pd-lkml(a)3b.pm> igc: fix netdev not re-attached after resume if interface is down Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Sun Jian <sun.jian.kdev(a)gmail.com> net: fix skb length accounting after generic XDP frag adjustment Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Doruk Tan Ozturk <doruk(a)0sec.ai> net: usb: ipheth: fix carrier_work UAF on disconnect Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Jiangshan Yi <yijiangshan(a)kylinos.cn> usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Ishaan Dandekar <ishaan.dandekar(a)gmail.com> usb: quirks: Add ShanWan gamepad to quirk list Nikhil Solanke <nikhilsolanke5(a)gmail.com> usb: core: Add quirk for 255-bytes initial config read Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Dongli Zhang <dongli.zhang(a)oracle.com> net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Clamp negative current limits Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Avoid overflow in maximum power calculation Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Hongyan Xu <getshell(a)seu.edu.cn> watchdog: at91sam9_wdt: prevent timer rearm during teardown Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Alexandra Winter <wintera(a)linux.ibm.com> s390/ism: Fix UAF of sba and ieq during ism_dev_exit() Bhargava Marreddy <bhargava.marreddy(a)broadcom.com> bnge: Fix resource leak in bnge_init_nic() error path Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Eric Dumazet <edumazet(a)google.com> netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: consolidate xmit path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Refresh VNIC default ring on queue restart if needed Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Determine and store default RX ring in vnic structure Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() Bobby Eshleman <bobbyeshleman(a)meta.com> net/mlx5e: fix BQL reset on SQ re-activation Alok Tiwari <alok.a.tiwari(a)oracle.com> bnge: use int for bnge_fix_rings_count() return value Stefan Agner <stefan(a)agner.ch> net: stmmac: resume PHY before hardware setup when opening the interface Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Marcin Bernatowicz <marcin.bernatowicz(a)linux.intel.com> drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Jia Jia <physicalmtea(a)gmail.com> vhost-scsi: reject feature changes after endpoint Linfeng Sun <slf(a)hdu.edu.cn> vhost-scsi: Validate T10 PI scatterlist counts Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate metadata when processing requests Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate launch-time metadata size Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: clear metadata pointer when no timestamp is requested Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: pass TX metadata pointer by reference Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: require at least 16 bytes of TX metadata Will Chen <will.chen.tty(a)gmail.com> bnxt: fix memory leak in bnxt_queue_mem_alloc error cases Pavel Begunkov <asml.silence(a)gmail.com> eth: bnxt: support qcfg provided rx page size Pavel Begunkov <asml.silence(a)gmail.com> eth: bnxt: store rx buffer size per queue Pavel Begunkov <asml.silence(a)gmail.com> net: pass queue rx page size from memory provider Pavel Begunkov <asml.silence(a)gmail.com> net: add bare bone queue configs Jakub Kicinski <kuba(a)kernel.org> net: reduce indent of struct netdev_queue_mgmt_ops members Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix type confusion in notification logic Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus_core) Use guard() for mutex protection Christian Borntraeger <borntraeger(a)linux.ibm.com> vdpa/mlx5: Fix buffer length in create_direct_keys() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Propagate untrusted pointer state in commuted arithmetic Eduard Zingerman <eddyz87(a)gmail.com> bpf: split check_reg_sane_offset() in two parts Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Matti Vaittinen <mazziesaccount(a)gmail.com> watchdog: bd96801_wdt: Fix timeout for enabled WDG Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: cancel pending PCI reset work on AER recovery Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: keep the health thread stopped during reset Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Satish Kharat <satishkh(a)cisco.com> enic: fix tx_hang_reset use-after-free on device removal Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix speed configuration residue after driver reload Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Qingfang Deng <qingfang.deng(a)linux.dev> ovpn: fix incorrect use of rcu_access_pointer() Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure TCP vars are initialized first Antonio Quartulli <antonio(a)openvpn.net> ovpn: disable IPv4 redirects on MP interfaces Antonio Quartulli <antonio(a)openvpn.net> ovpn: hash floated peer by transport identity only Antonio Quartulli <antonio(a)openvpn.net> ovpn: zero-initialize sockaddr before learning a floated endpoint Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure socket is owned by ovpn before deref sk_user_data Antonio Quartulli <antonio(a)openvpn.net> ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET Antonio Quartulli <antonio(a)openvpn.net> ovpn: skip rehash for peers already removed from by_id Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Ralf Lici <ralf(a)mandelbit.com> ovpn: add missing rtnl_link_ops->get_size callback Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function Kuba Piecuch <jpiecuch(a)google.com> selftests/sched_ext: Handle sleeping task affinity changes in numa test Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Yun Zhou <yun.zhou(a)windriver.com> xfs: handle NULL b_addr in xfs_buf_free Daniel Drake <dan(a)reactivated.net> arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle Akhil P Oommen <akhilpo(a)oss.qualcomm.com> arm64: dts: qcom: purwa: Fix GPU IOMMU property Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: rename x1p42100 to purwa Aleksandrs Vinarskis <alex(a)vinarskis.com> arm64: dts: qcom: Rework X1-based Asus Zenbook A14's displays Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: rename x1e80100 to hamoa Ray Wu <ray.wu(a)amd.com> drm/amd/display: Check for tg ops in dce110_set_avmute Ray Wu <ray.wu(a)amd.com> drm/amd/display: Add AV mute wait frames to dce110_set_avmute Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Peter Zijlstra <peterz(a)infradead.org> sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") Ingo Molnar <mingo(a)kernel.org> sched/fair: Separate se->vlag from se->vprot Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 9 + .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/arm64/boot/dts/qcom/Makefile | 2 + arch/arm64/boot/dts/qcom/hamoa-iot-som.dtsi | 4 +- .../qcom/{x1e80100-pmics.dtsi => hamoa-pmics.dtsi} | 0 .../boot/dts/qcom/{x1e80100.dtsi => hamoa.dtsi} | 0 .../boot/dts/qcom/{x1p42100.dtsi => purwa.dtsi} | 6 +- .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 + arch/arm64/boot/dts/qcom/x1-asus-zenbook-a14.dtsi | 9 +- arch/arm64/boot/dts/qcom/x1-crd.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1e001de-devkit.dts | 4 +- .../dts/qcom/x1e78100-lenovo-thinkpad-t14s.dtsi | 4 +- .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 +- .../boot/dts/qcom/x1e80100-asus-zenbook-a14.dts | 10 +- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- .../qcom/x1e80100-dell-inspiron-14-plus-7441.dts | 2 +- .../boot/dts/qcom/x1e80100-dell-latitude-7455.dts | 2 +- .../boot/dts/qcom/x1e80100-dell-xps13-9345.dts | 4 +- .../boot/dts/qcom/x1e80100-hp-omnibook-x14.dts | 4 +- .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 +- .../boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 4 +- .../dts/qcom/x1p42100-asus-zenbook-a14-lcd.dts | 62 ++++ .../boot/dts/qcom/x1p42100-asus-zenbook-a14.dts | 133 +------- .../boot/dts/qcom/x1p42100-asus-zenbook-a14.dtsi | 138 +++++++++ arch/arm64/boot/dts/qcom/x1p42100-crd.dts | 2 +- .../boot/dts/qcom/x1p42100-hp-omnibook-x14.dts | 4 +- .../boot/dts/qcom/x1p42100-lenovo-thinkbook-16.dts | 4 +- arch/arm64/include/asm/ptdump.h | 2 - arch/arm64/mm/mmu.c | 43 +-- arch/arm64/mm/ptdump.c | 11 +- arch/s390/kvm/pci.c | 31 +- arch/x86/kernel/cpu/common.c | 10 + arch/x86/kernel/cpu/mce/core.c | 2 +- arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 34 ++- arch/x86/kvm/svm/svm.h | 1 + block/blk-mq.c | 34 +-- drivers/android/binder/process.rs | 12 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/bluetooth/btrtl.c | 13 + drivers/bluetooth/btusb.c | 2 + drivers/counter/microchip-tcb-capture.c | 4 +- drivers/dibs/dibs_loopback.c | 1 - drivers/dibs/dibs_main.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/gpu/drm/v3d/v3d_drv.h | 6 + drivers/gpu/drm/v3d/v3d_sched.c | 9 +- drivers/gpu/drm/xe/xe_uc.c | 7 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc4282.c | 20 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/hwmon/pmbus/pmbus_core.c | 340 +++++++++------------ drivers/input/evdev.c | 27 +- drivers/iommu/intel/iommu.c | 11 +- drivers/misc/fastrpc.c | 27 +- drivers/misc/mei/client.c | 25 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 2 - drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 163 +++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/google/gve/gve_main.c | 9 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- drivers/net/ethernet/intel/igc/igc_main.c | 10 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 4 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 8 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +- drivers/net/netdevsim/netdev.c | 7 +- drivers/net/ovpn/main.c | 64 ++-- drivers/net/ovpn/netlink.c | 6 + drivers/net/ovpn/peer.c | 172 ++++++++--- drivers/net/ovpn/peer.h | 1 + drivers/net/ovpn/socket.c | 9 + drivers/net/phy/mediatek/mtk.h | 8 +- drivers/net/tap.c | 24 +- drivers/net/thunderbolt/main.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/apple-spmi-nvmem.c | 20 +- drivers/nvmem/core.c | 24 +- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 - drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 ++++ drivers/pinctrl/qcom/pinctrl-ipq8064.c | 8 +- drivers/pinctrl/qcom/pinctrl-msm.h | 5 + drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/net/ism_drv.c | 19 +- drivers/scsi/scsi_debug.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/8250/8250_of.c | 38 +++ drivers/tty/serial/amba-pl011.c | 86 ++++-- drivers/tty/serial/qcom_geni_serial.c | 43 +-- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/core/config.c | 32 +- drivers/usb/core/quirks.c | 7 + drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/usb/misc/usbio.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 3 +- drivers/vhost/scsi.c | 17 ++ drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/at91sam9_wdt.c | 4 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 1 + fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- fs/xfs/xfs_buf.c | 2 +- include/linux/dibs.h | 2 +- include/linux/mmap_lock.h | 1 + include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psi.h | 4 +- include/linux/sched.h | 13 +- include/linux/usb/quirks.h | 3 + include/net/act_api.h | 19 ++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/libeth/xsk.h | 2 +- include/net/netdev_queues.h | 47 ++- include/net/netdev_rx_queue.h | 2 + include/net/netfilter/nf_flow_table.h | 1 + include/net/page_pool/types.h | 1 + include/net/route.h | 2 + include/net/sch_generic.h | 1 + include/net/xdp_sock.h | 47 +-- include/net/xdp_sock_drv.h | 77 ++++- kernel/bpf/verifier.c | 68 +++-- kernel/cgroup/cgroup.c | 23 +- kernel/events/core.c | 67 ++-- kernel/futex/core.c | 85 ++++-- kernel/sched/fair.c | 148 +++++++-- kernel/sched/psi.c | 75 ++++- kernel/trace/ring_buffer.c | 13 +- kernel/trace/trace_events.c | 4 +- mm/damon/ops-common.c | 13 +- mm/damon/paddr.c | 2 + mm/damon/vaddr.c | 3 +- mm/filemap.c | 6 + mm/huge_memory.c | 49 +-- mm/pagewalk.c | 36 ++- mm/ptdump.c | 7 + mm/vmalloc.c | 40 ++- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/datagram.c | 3 + net/core/dev.c | 27 +- net/core/netdev_rx_queue.c | 21 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 +++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/inet_fragment.c | 10 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 43 +-- net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++--- net/netfilter/ipvs/ip_vs_ctl.c | 77 ++++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 +++++--- net/netfilter/nf_flow_table_core.c | 1 + net/netfilter/nf_flow_table_ip.c | 95 ++++-- net/netfilter/nf_flow_table_path.c | 9 +- net/netfilter/nf_tables_api.c | 4 +- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 +++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 ++- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 18 +- net/vmw_vsock/virtio_transport.c | 14 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xdp/xdp_umem.c | 2 + net/xdp/xsk.c | 11 +- net/xdp/xsk_buff_pool.c | 6 +- samples/damon/mtier.c | 3 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++ sound/hda/codecs/side-codecs/tas2781_hda_spi.c | 3 +- sound/usb/endpoint.c | 6 +- sound/usb/fcp.c | 10 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/us144mkii_capture.c | 1 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- tools/testing/selftests/net/tls.c | 57 ++++ tools/testing/selftests/sched_ext/numa.bpf.c | 13 +- 281 files changed, 3279 insertions(+), 1604 deletions(-)

2 months

[PATCH 6.6 000/156] 6.6.152-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.152 release. There are 156 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.152-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.152-rc1 David Lechner <dlechner(a)baylibre.com> regulator: devres: fix devm_regulator_get_enable_read_voltage() return Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp_sigpool: Use kref_get_unless_zero() Dan Carpenter <dan.carpenter(a)linaro.org> net/tcp_sigpool: Fix some off by one bugs Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Masahiro Yamada <masahiroy(a)kernel.org> fortify: refactor test_fortify Makefile to fix some build problems Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling David Lechner <dlechner(a)baylibre.com> regulator: devres: add API for reference voltage supplies Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp: Add TCP-AO config and structures Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp: Prepare tcp_md5sig_pool for TCP-AO Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Rob Herring <robh(a)kernel.org> hwmon: (lm25066) Use i2c_get_match_data() Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Xin Long <lucien.xin(a)gmail.com> net: sched: refine software bypass handling in tc_run Jianbo Liu <jianbol(a)nvidia.com> net: sched: cls_api: fix slab-use-after-free in fl_dump_key Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: make skip_sw actually skip software Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: cls_api: add filter counter Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: cls_api: add skip_sw counter Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jordan Rife <jordan(a)jrife.io> bpf: tcp: Avoid socket skips and repeats during iteration Jordan Rife <jordan(a)jrife.io> bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Jordan Rife <jordan(a)jrife.io> bpf: tcp: Get rid of st_bucket_done Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API ------------- Diffstat: .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- Documentation/driver-api/driver-model/devres.rst | 1 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 19 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 ++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/regulator/devres.c | 59 ++++ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- fs/btrfs/inode.c | 1 + fs/crypto/fscrypt_private.h | 32 +- fs/crypto/keyring.c | 212 +++++------ fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/regulator/consumer.h | 7 + include/linux/tcp.h | 9 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/pkt_cls.h | 18 + include/net/route.h | 2 + include/net/sch_generic.h | 4 + include/net/tcp.h | 58 +-- include/net/tcp_ao.h | 90 +++++ include/uapi/linux/tcp.h | 2 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 82 +++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 10 +- kernel/trace/trace_events.c | 2 + lib/.gitignore | 2 - lib/Makefile | 34 +- lib/test_fortify/.gitignore | 2 + lib/test_fortify/Makefile | 29 ++ net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 13 + net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/Kconfig | 17 + net/ipv4/Makefile | 1 + net/ipv4/fib_semantics.c | 101 +++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp.c | 145 ++------ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 390 ++++++++++++++------- net/ipv4/tcp_minisocks.c | 21 +- net/ipv4/tcp_sigpool.c | 357 +++++++++++++++++++ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/ipv6/tcp_ipv6.c | 60 ++-- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++-- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 ++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 47 ++- net/sched/cls_bpf.c | 2 + net/sched/cls_flower.c | 2 + net/sched/cls_matchall.c | 2 + net/sched/cls_route.c | 35 +- net/sched/cls_u32.c | 4 + net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- scripts/remove-stale-files | 2 + security/integrity/ima/ima_appraise.c | 9 +- sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 166 files changed, 2407 insertions(+), 1036 deletions(-)

2 months

[PATCH 6.1 000/609] 6.1.183-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.183 release. There are 609 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.183-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.183-rc1 Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Fix non-existent ALARM warning Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Fix register for nct6799 David Lechner <dlechner(a)baylibre.com> regulator: devres: fix devm_regulator_get_enable_read_voltage() return Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix a use-after-free problem in rxe_mmap Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Masahiro Yamada <masahiroy(a)kernel.org> fortify: refactor test_fortify Makefile to fix some build problems Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling David Lechner <dlechner(a)baylibre.com> regulator: devres: add API for reference voltage supplies Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Łukasz Patron <priv.luk(a)gmail.com> net: qrtr: ns: Raise lookup limit to 128 Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Rob Herring <robh(a)kernel.org> hwmon: (lm25066) Use i2c_get_match_data() Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jordan Rife <jordan(a)jrife.io> bpf: tcp: Avoid socket skips and repeats during iteration Jordan Rife <jordan(a)jrife.io> bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Jordan Rife <jordan(a)jrife.io> bpf: tcp: Get rid of st_bucket_done Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Jian Wen <wenjianhn(a)gmail.com> tcp: add a scheduling point in established_get_first() Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <linux(a)rempel-privat.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Give up GC if MSG_PEEK intervened. Pengfei Zhang <zhangfeionline(a)gmail.com> ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775) Fix access to temperature configuration registers Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Additional TEMP registers for nct6799 Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Add support for 18 IN readings for nct6799 Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Increase and reorder ALARM/BEEP bits Ahmad Khalifa <ahmad(a)khalifa.ws> hwmon: (nct6775) Fix IN scaling factors for 6798/6799 Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6755) Add support for NCT6799D Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race John Garry <john.g.garry(a)oracle.com> scsi: libsas: Delete struct scsi_core Jason Yan <yanaijie(a)huawei.com> scsi: libsas: Abort all in-flight requests when device is gone HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Eric Dumazet <edumazet(a)google.com> ipv6: introduce dst_rt6_info() helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Sean Anderson <sean.anderson(a)seco.com> phy: zynqmp: Allow variation in refclk rate Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Fix sequence number when no EOF Isaac Scott <isaac.scott(a)ideasonboard.com> media: uvcvideo: Implement dual stream quirk to fix loss of usb packets Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug Wentao Guan <guanwentao(a)uniontech.com> bpf: drop bpf_lsm_getselfattr from hook list Namjae Jeon <linkinjeon(a)kernel.org> exfat: validate cluster allocation bits of the allocation bitmap Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Weiming Shi <bestswngs(a)gmail.com> tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv6: ndisc: fix NULL deref in accept_untracked_na() Jacob Keller <jacob.e.keller(a)intel.com> i40e: remove read access to debugfs files Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Qingfang Deng <dqfext(a)gmail.com> ppp: enable TX scatter-gather Qingfang Deng <dqfext(a)gmail.com> ppp: convert to percpu netstats Qingfang Deng <dqfext(a)gmail.com> ppp: use IFF_NO_QUEUE in virtual interfaces Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Kuniyuki Iwashima <kuniyu(a)amazon.com> selftest: af_unix: Add Kconfig file. Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer dirty packs for eBPF allocations Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Prefer packs that won't trigger an IBPB flush on allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Skip redundant IBPB in pack allocator Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Restrict JIT predictor flush to cBPF Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Enable IBPB flush on BPF JIT allocation Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> bpf: Support for hardening against JIT spraying Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Guoqing Jiang <guoqing.jiang(a)linux.dev> RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Allow KASAN to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Cure some more scoped_seqlock() optimization fails Sandipan Das <sandipan.das(a)amd.com> perf/x86/amd/brs: Fix kernel address leakage Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Documentation/driver-api/driver-model/devres.rst | 1 + Makefile | 4 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kvm/vcpu.c | 78 ++- arch/s390/kvm/pci.c | 28 +- arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/compressed/Makefile | 1 + arch/x86/events/amd/brs.c | 10 +- arch/x86/include/asm/nospec-branch.h | 4 + arch/x86/kernel/cpu/bugs.c | 50 +- arch/x86/kvm/mmu/mmu.c | 73 +-- arch/x86/kvm/mmu/mmu_internal.h | 3 +- arch/x86/kvm/mmu/paging_tmpl.h | 14 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/net/bpf_jit_comp.c | 3 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/ata/sata_dwc_460ex.c | 8 +- drivers/ata/sata_mv.c | 2 +- drivers/block/rbd.c | 7 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btqca.c | 2 +- drivers/cdrom/cdrom.c | 1 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/dma/sun6i-dma.c | 11 +- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 30 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 26 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 3 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/adt7470.c | 131 +++-- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 5 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/nct6775-core.c | 435 ++++++++++++----- drivers/hwmon/nct6775-i2c.c | 2 + drivers/hwmon/nct6775-platform.c | 41 +- drivers/hwmon/nct6775.h | 33 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 10 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwmon/pmbus/lm25066.c | 19 +- drivers/hwmon/pmbus/pmbus_core.c | 2 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/infiniband/core/addr.c | 6 +- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/sw/rxe/rxe_mmap.c | 19 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/evdev.c | 27 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + drivers/media/platform/marvell/cafe-driver.c | 1 + drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/usb/uvc/uvc_video.c | 76 ++- drivers/media/usb/uvc/uvcvideo.h | 4 + drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/fastrpc.c | 3 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/net/amt.c | 87 +++- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 22 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_main.c | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 33 ++ drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +---- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- .../net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +- .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/geneve.c | 3 + drivers/net/gtp.c | 5 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/phy/phylink.c | 29 +- drivers/net/ppp/ppp_generic.c | 154 +++--- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/thunderbolt.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 22 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/mac80211_hwsim.c | 1 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/phy/xilinx/phy-zynqmp.c | 127 +++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/platform/loongarch/loongson-laptop.c | 1 + .../uncore-frequency/uncore-frequency-common.c | 11 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/regulator/devres.c | 59 +++ drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 26 +- drivers/s390/net/qeth_core.h | 4 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/aic94xx/aic94xx_hwi.c | 2 +- drivers/scsi/aic94xx/aic94xx_init.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +- drivers/scsi/isci/host.h | 2 +- drivers/scsi/isci/init.c | 4 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_ata.c | 8 +- drivers/scsi/libsas/sas_discover.c | 35 +- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/libsas/sas_host_smp.c | 4 +- drivers/scsi/libsas/sas_init.c | 51 +- drivers/scsi/libsas/sas_phy.c | 8 +- drivers/scsi/libsas/sas_port.c | 6 +- drivers/scsi/libsas/sas_scsi_host.c | 14 +- drivers/scsi/mvsas/mv_init.c | 4 +- drivers/scsi/pm8001/pm8001_init.c | 2 +- drivers/scsi/scsi_debug.c | 12 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 12 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 19 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 9 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/inode.c | 1 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/crypto/fscrypt_private.h | 32 +- fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keyring.c | 212 ++++----- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/exfat/balloc.c | 54 ++- fs/f2fs/super.c | 25 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/proc/namespaces.c | 4 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/misc.c | 34 +- fs/smb/client/sess.c | 2 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/vfs_cache.c | 6 +- include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/filter.h | 15 +- include/linux/fscrypt.h | 18 +- include/linux/netdevice.h | 5 - include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/ppp_channel.h | 3 +- include/linux/regulator/consumer.h | 7 + include/linux/seqlock.h | 10 +- include/media/videobuf2-core.h | 8 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/af_unix.h | 1 + include/net/bluetooth/hci_core.h | 18 + include/net/bluetooth/l2cap.h | 1 + include/net/bluetooth/rfcomm.h | 3 + include/net/ip6_fib.h | 6 +- include/net/ip6_route.h | 11 +- include/net/ip_vs.h | 56 ++- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/route.h | 2 + include/net/sch_generic.h | 1 + include/net/sctp/structs.h | 3 +- include/scsi/libsas.h | 8 +- include/uapi/linux/btrfs.h | 2 +- io_uring/rw.c | 28 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/core.c | 68 ++- kernel/bpf/dispatcher.c | 2 +- kernel/bpf/verifier.c | 32 +- kernel/futex/core.c | 82 +++- kernel/sched/psi.c | 6 + kernel/trace/ftrace.c | 13 + kernel/trace/ring_buffer.c | 10 +- kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 5 +- kernel/trace/trace_probe.c | 13 +- lib/.gitignore | 2 - lib/Makefile | 34 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + lib/test_fortify/.gitignore | 2 + lib/test_fortify/Makefile | 29 ++ mm/damon/core.c | 13 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 20 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/atm/common.c | 14 +- net/bluetooth/6lowpan.c | 20 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_sync.c | 13 +- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/l2cap_core.c | 38 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_mrp.c | 8 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/can/bcm.c | 528 +++++++++++++++------ net/can/isotp.c | 295 +++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 22 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/dst_cache.c | 2 +- net/core/filter.c | 2 +- net/core/lwt_bpf.c | 4 +- net/core/sock.c | 1 - net/core/sock_map.c | 2 + net/core/xdp.c | 2 +- net/hsr/hsr_slave.c | 2 + net/ipv4/fib_semantics.c | 101 ++-- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/nexthop.c | 2 +- net/ipv4/route.c | 31 +- net/ipv4/tcp_bpf.c | 4 +- net/ipv4/tcp_ipv4.c | 296 +++++++++--- net/ipv4/udp_offload.c | 4 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/icmp.c | 8 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ila/ila_lwt.c | 4 +- net/ipv6/ip6_fib.c | 17 +- net/ipv6/ip6_output.c | 20 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/ip6mr.c | 2 +- net/ipv6/ndisc.c | 12 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 6 +- net/ipv6/route.c | 36 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 11 +- net/ipv6/xfrm6_policy.c | 3 +- net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ip6.c | 2 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/iface.c | 8 +- net/mac80211/rx.c | 2 + net/mac80211/s1g.c | 4 + net/mac802154/llsec.c | 5 + net/mpls/af_mpls.c | 4 + net/mpls/mpls_iptunnel.c | 2 +- net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 4 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 44 +- net/netfilter/ipvs/ip_vs_core.c | 232 +++++---- net/netfilter/ipvs/ip_vs_ctl.c | 77 ++- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 50 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +-- net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 56 ++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_core.c | 8 +- net/netfilter/nf_flow_table_ip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/nft_rt.c | 2 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 26 +- net/openvswitch/datapath.c | 54 ++- net/openvswitch/datapath.h | 2 +- net/openvswitch/flow.c | 11 +- net/openvswitch/meter.c | 33 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 13 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/recv.c | 15 + net/rds/tcp.c | 14 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/act_tunnel_key.c | 14 +- net/sched/cls_route.c | 35 +- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/ipv6.c | 2 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 26 +- net/sctp/sm_statefuns.c | 8 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 2 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/core.c | 5 + net/tipc/discover.c | 14 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/node.c | 15 +- net/tipc/socket.c | 3 +- net/tls/tls_sw.c | 2 +- net/unix/af_unix.c | 2 + net/unix/garbage.c | 81 ++-- net/vmw_vsock/virtio_transport.c | 14 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 20 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 7 +- scripts/remove-stale-files | 2 + security/integrity/ima/ima_appraise.c | 9 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 13 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 35 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 20 +- sound/usb/midi.c | 2 + sound/usb/quirks.c | 2 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- tools/testing/selftests/net/af_unix/config | 4 + tools/testing/selftests/net/openvswitch/config | 16 + 563 files changed, 6112 insertions(+), 2862 deletions(-)

2 months

[PATCH 5.15 000/456] 5.15.216-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.216 release. There are 456 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.216-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.216-rc1 Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix a use-after-free problem in rxe_mmap Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Łukasz Patron <priv.luk(a)gmail.com> net: qrtr: ns: Raise lookup limit to 128 Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Linyu Yuan <quic_linyyuan(a)quicinc.com> selftests/ftrace: Add test case for GRP/ only input Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Scott Mayhew <smayhew(a)redhat.com> nfs4: take a reference on the nfs_client when running FREE_STATEID Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Oleksij Rempel <linux(a)rempel-privat.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Sean Anderson <sean.anderson(a)seco.com> phy: zynqmp: Allow variation in refclk rate Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Sabrina Dubroca <sd(a)queasysnail.net> tls: separate no-async decryption request handling from async Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Fix sequence number when no EOF Isaac Scott <isaac.scott(a)ideasonboard.com> media: uvcvideo: Implement dual stream quirk to fix loss of usb packets Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Eric Dumazet <edumazet(a)google.com> raw: fix a typo in raw_icmp_error() Eric Dumazet <edumazet(a)google.com> raw: remove unused variables from raw6_icmp_error() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Weiming Shi <bestswngs(a)gmail.com> tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Lee Jones <lee(a)kernel.org> can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Eric Dumazet <edumazet(a)google.com> raw: use more conventional iterators Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Ong Boon Leong <boon.leong.ong(a)intel.com> net: stmmac: add tc flower filter for EtherType matching Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Eddie James <eajames(a)linux.ibm.com> hwmon: (occ) Delay hwmon registration until user request Eddie James <eajames(a)linux.ibm.com> hwmon: (occ) Add sysfs entries for additional extended status bits Eddie James <eajames(a)linux.ibm.com> hwmon: (occ) Add sysfs entry for OCC mode Eddie James <eajames(a)linux.ibm.com> hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Jiaxin Yu <jiaxin.yu(a)mediatek.com> ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Alexander Gordeev <agordeev(a)linux.ibm.com> sched/vtime: Get rid of generic vtime_task_switch() implementation Nicholas Piggin <npiggin(a)gmail.com> powerpc: remove the last remnants of cputime_t He Ying <heying24(a)huawei.com> powerpc/time: Fix sparse warnings Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Colin Ian King <colin.i.king(a)gmail.com> ata: sata_dwc_460ex: remove variable num_processed Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Guoqing Jiang <guoqing.jiang(a)linux.dev> RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Sean Christopherson <seanjc(a)google.com> KVM: VMX: Make vmread_error_trampoline() uncallable from C code Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Daehyeon Ko <4ncienth(a)gmail.com> macsec: don't read an unset MAC header in macsec_encrypt() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex: Prevent lockup in requeue-PI during signal/ timeout wakeup Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix potential UAF when ddgst mismatch ------------- Diffstat: Makefile | 4 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/include/asm/cputime.h | 30 +- arch/powerpc/include/asm/time.h | 1 + arch/powerpc/kernel/time.c | 93 +++- arch/powerpc/platforms/chrp/time.c | 2 - arch/powerpc/platforms/ps3/mm.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/compressed/Makefile | 1 + arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/kvm/vmx/vmx_ops.h | 16 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/ata/sata_dwc_460ex.c | 21 +- drivers/block/rbd.c | 7 +- drivers/bluetooth/btqca.c | 2 +- drivers/cdrom/cdrom.c | 1 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/dma/sun6i-dma.c | 11 +- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 9 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 24 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/adt7470.c | 131 +++-- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 5 +- drivers/hwmon/nct6775.c | 12 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/occ/common.c | 138 +++-- drivers/hwmon/occ/common.h | 7 +- drivers/hwmon/occ/p8_i2c.c | 2 +- drivers/hwmon/occ/p9_sbe.c | 2 +- drivers/hwmon/occ/sysfs.c | 157 ++++-- drivers/hwmon/pmbus/pmbus_core.c | 2 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-imx.c | 1 + drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 +- drivers/infiniband/sw/rxe/rxe_mmap.c | 19 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/evdev.c | 27 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 12 + drivers/media/test-drivers/vivid/vivid-vid-cap.c | 6 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/usb/uvc/uvc_video.c | 78 ++- drivers/media/usb/uvc/uvcvideo.h | 4 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/fastrpc.c | 3 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/raw/mtk_ecc.c | 16 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 22 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 22 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_main.c | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 33 ++ drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 156 ++++++ drivers/net/geneve.c | 3 + drivers/net/macsec.c | 2 +- drivers/net/phy/phylink.c | 29 +- drivers/net/ppp/ppp_generic.c | 18 +- drivers/net/ppp/pppoe.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/thunderbolt.c | 20 +- drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 20 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/mac80211_hwsim.c | 1 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 4 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/nvme/target/tcp.c | 4 +- drivers/phy/xilinx/phy-zynqmp.c | 127 +++-- drivers/pinctrl/Kconfig | 1 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 26 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 12 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 6 +- drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 19 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 9 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/cifs/cifssmb.c | 12 +- fs/cifs/smb2ops.c | 25 +- fs/crypto/fscrypt_private.h | 32 +- fs/crypto/keyring.c | 212 ++++---- fs/exec.c | 2 +- fs/ksmbd/smb2misc.c | 5 + fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 13 + fs/proc/namespaces.c | 4 +- include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/netdevice.h | 5 - include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/vtime.h | 6 + include/media/videobuf2-core.h | 8 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/bluetooth/l2cap.h | 1 + include/net/bluetooth/rfcomm.h | 3 + include/net/ip_vs.h | 20 +- include/net/raw.h | 5 +- include/net/rawv6.h | 6 +- include/net/route.h | 2 + include/net/sctp/structs.h | 3 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/verifier.c | 31 +- kernel/futex/core.c | 95 ++-- kernel/sched/cputime.c | 13 - kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 5 +- kernel/trace/trace_probe.c | 13 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 2 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/l2cap_core.c | 41 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_mrp.c | 8 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/can/bcm.c | 564 ++++++++++++++++----- net/can/isotp.c | 295 ++++++++--- net/can/j1939/transport.c | 20 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/lwt_bpf.c | 4 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/hsr/hsr_slave.c | 2 + net/ipv4/fib_semantics.c | 101 ++-- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/nexthop.c | 2 +- net/ipv4/raw.c | 91 ++-- net/ipv4/raw_diag.c | 33 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 4 +- net/ipv4/udp_offload.c | 4 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_tunnel.c | 3 + net/ipv6/raw.c | 102 ++-- net/ipv6/route.c | 8 +- net/iucv/af_iucv.c | 21 +- net/mac80211/iface.c | 8 +- net/mac80211/rx.c | 2 + net/mac80211/s1g.c | 4 + net/mac802154/llsec.c | 5 + net/mpls/af_mpls.c | 4 + net/mptcp/options.c | 12 +- net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 44 +- net/netfilter/ipvs/ip_vs_core.c | 1 + net/netfilter/ipvs/ip_vs_ctl.c | 77 ++- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 - net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 26 +- net/openvswitch/datapath.c | 54 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/flow.c | 11 +- net/openvswitch/meter.c | 33 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 13 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/recv.c | 15 + net/rds/tcp.c | 14 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/act_tunnel_key.c | 14 +- net/sched/cls_route.c | 35 +- net/sched/sch_cake.c | 1 - net/sctp/associola.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 26 +- net/sctp/sm_statefuns.c | 8 +- net/sctp/stream.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 2 +- net/smc/smc_llc.c | 3 +- net/tipc/core.c | 5 + net/tipc/discover.c | 14 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/node.c | 15 +- net/tipc/socket.c | 3 +- net/tls/tls_sw.c | 15 +- net/vmw_vsock/virtio_transport.c | 14 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 4 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 4 +- security/integrity/ima/ima_appraise.c | 9 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/bt-sco.c | 18 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 35 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 20 +- sound/usb/midi.c | 2 + sound/usb/quirks.c | 2 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 23 +- .../ftrace/test.d/dynevent/add_remove_kprobe.tc | 7 + 394 files changed, 4235 insertions(+), 1862 deletions(-)

2 months

[PATCH 5.10 000/389] 5.10.265-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.265 release. There are 389 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.265-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.265-rc1 Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Javier Carrasco <javier.carrasco.cruz(a)gmail.com> hwmon: (adt7470) Add missing dependency on REGMAP_I2C Jonas Gorski <jonas.gorski(a)bisdn.de> prestera: fix fallback to previous version on same major version Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Aaron Tomlin <atomlin(a)atomlin.com> mips: sched: Fix CPUMASK_OFFSTACK memory corruption Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix a use-after-free problem in rxe_mmap Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Marco Elver <elver(a)google.com> Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: extract sctp_v4_err_handle function from sctp_v4_err Xin Long <lucien.xin(a)gmail.com> sctp: extract sctp_v6_err_handle function from sctp_v6_err Xin Long <lucien.xin(a)gmail.com> sctp: remove the unessessary hold for idev in sctp_v6_err Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Łukasz Patron <priv.luk(a)gmail.com> net: qrtr: ns: Raise lookup limit to 128 Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Vadym Kochan <vkochan(a)marvell.com> net: marvell: prestera: try to load previous fw version Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Randy Dunlap <rdunlap(a)infradead.org> net: openvswitch: fix kernel-doc warnings in flow.c Andrew Lunn <andrew(a)lunn.ch> net: openvswitch: Fix kerneldoc warnings Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Leon Romanovsky <leon(a)kernel.org> net/mlx5: Remove second FW tracer check Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Scott Mayhew <smayhew(a)redhat.com> nfs4: take a reference on the nfs_client when running FREE_STATEID Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: SCO: Fix UAF on sco_sock_timeout Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Oleksij Rempel <linux(a)rempel-privat.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Pengfei Zhang <zhangfeionline(a)gmail.com> ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Chris Packham <chris.packham(a)alliedtelesis.co.nz> hwmon: (adt7470) Convert to use regmap Chris Packham <chris.packham(a)alliedtelesis.co.nz> hwmon: (adt7470) Fix some style issues Chris Packham <chris.packham(a)alliedtelesis.co.nz> hwmon: (adt7470) Create functions for updating readings and limits Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Sabrina Dubroca <sd(a)queasysnail.net> tls: separate no-async decryption request handling from async Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Fix sequence number when no EOF Isaac Scott <isaac.scott(a)ideasonboard.com> media: uvcvideo: Implement dual stream quirk to fix loss of usb packets Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Nikolay Aleksandrov <nikolay(a)nvidia.com> net: bridge: vlan: fix global vlan option range dumping Eric Dumazet <edumazet(a)google.com> raw: fix a typo in raw_icmp_error() Eric Dumazet <edumazet(a)google.com> raw: remove unused variables from raw6_icmp_error() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Weiming Shi <bestswngs(a)gmail.com> tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Lee Jones <lee(a)kernel.org> can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Eric Dumazet <edumazet(a)google.com> raw: use more conventional iterators Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Nikolay Aleksandrov <nikolay(a)nvidia.com> net: bridge: vlan: add support for dumping global vlan options Nikolay Aleksandrov <nikolay(a)nvidia.com> net: bridge: vlan: add support for global options Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Jiaxin Yu <jiaxin.yu(a)mediatek.com> ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Colin Ian King <colin.i.king(a)gmail.com> ata: sata_dwc_460ex: remove variable num_processed Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Ramon Fontes <ramonreisfontes(a)gmail.com> mac80211_hwsim: add 6GHz channels Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Nikolay Borisov <nborisov(a)suse.com> btrfs: remove crc_check logic from free space Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Sean Christopherson <seanjc(a)google.com> KVM: VMX: Make vmread_error_trampoline() uncallable from C code Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Daehyeon Ko <4ncienth(a)gmail.com> macsec: don't read an unset MAC header in macsec_encrypt() Bradley Morgan <include(a)grrlz.net> cpu: hotplug: Bound hotplug states sysfs output Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix potential UAF when ddgst mismatch ------------- Diffstat: Makefile | 4 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/mips/kernel/mips-mt-fpaff.c | 28 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/kvm/mmu/mmu.c | 2 + arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/kvm/vmx/vmx_ops.h | 16 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/ata/sata_dwc_460ex.c | 21 +- drivers/block/rbd.c | 7 +- drivers/cdrom/cdrom.c | 1 + drivers/counter/microchip-tcb-capture.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/sun6i-dma.c | 11 +- drivers/firewire/net.c | 37 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 9 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/Kconfig | 1 + drivers/hwmon/adt7470.c | 605 +++++++++++++-------- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/nct6775.c | 12 +- drivers/hwmon/pmbus/pmbus_core.c | 2 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/infiniband/core/mad.c | 30 + drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/sw/rxe/rxe_mmap.c | 19 +- drivers/input/evdev.c | 27 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/intel/svm.c | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 12 + drivers/media/test-drivers/vivid/vivid-vid-cap.c | 6 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/usb/uvc/uvc_video.c | 78 ++- drivers/media/usb/uvc/uvcvideo.h | 4 + drivers/misc/fastrpc.c | 3 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/raw/mtk_ecc.c | 16 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 22 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 87 ++- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 18 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 7 +- .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/geneve.c | 3 + drivers/net/macsec.c | 2 +- drivers/net/phy/phylink.c | 29 +- drivers/net/ppp/pppoe.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 20 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/mac80211_hwsim.c | 75 ++- drivers/net/wireless/marvell/libertas/firmware.c | 1 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 4 + drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/nvme/target/tcp.c | 4 +- drivers/phy/xilinx/phy-zynqmp.c | 37 +- drivers/pinctrl/Kconfig | 1 + drivers/pinctrl/devicetree.c | 4 + drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 26 +- drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/comedi/drivers/comedi_parport.c | 13 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thunderbolt/eeprom.c | 9 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 19 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 9 +- fs/btrfs/free-space-cache.c | 38 +- fs/btrfs/free-space-cache.h | 1 - fs/ceph/caps.c | 1 + fs/cifs/cifssmb.c | 12 +- fs/cifs/smb2ops.c | 25 +- fs/crypto/fscrypt_private.h | 32 +- fs/crypto/keyring.c | 212 ++++---- fs/exec.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 13 + fs/proc/namespaces.c | 4 +- include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/netdevice.h | 5 - include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/media/videobuf2-core.h | 8 +- include/net/addrconf.h | 4 +- include/net/bluetooth/bluetooth.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/bluetooth/rfcomm.h | 3 + include/net/ip_vs.h | 20 +- include/net/raw.h | 5 +- include/net/rawv6.h | 6 +- include/net/route.h | 2 + include/net/sctp/structs.h | 3 +- include/uapi/linux/if_bridge.h | 14 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/verifier.c | 31 +- kernel/cpu.c | 9 +- kernel/futex/core.c | 82 ++- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 5 +- kernel/trace/trace_probe.c | 13 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 2 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/bluetooth/6lowpan.c | 18 +- net/bluetooth/af_bluetooth.c | 22 + net/bluetooth/hidp/core.c | 5 +- net/bluetooth/l2cap_core.c | 41 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bluetooth/sco.c | 27 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 14 +- net/bridge/br_vlan.c | 64 ++- net/bridge/br_vlan_options.c | 119 +++- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/can/bcm.c | 564 ++++++++++++++----- net/can/isotp.c | 295 +++++++--- net/can/j1939/transport.c | 20 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 2 +- net/ceph/osdmap.c | 12 +- net/core/lwt_bpf.c | 4 +- net/core/sock.c | 1 - net/ipv4/fib_semantics.c | 34 +- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/raw.c | 91 ++-- net/ipv4/raw_diag.c | 33 +- net/ipv4/route.c | 29 + net/ipv4/tcp_bpf.c | 4 +- net/ipv4/udp_offload.c | 4 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_fib.c | 17 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/raw.c | 102 ++-- net/ipv6/route.c | 8 +- net/iucv/af_iucv.c | 21 +- net/mac80211/iface.c | 8 +- net/mac80211/rx.c | 2 + net/mac802154/llsec.c | 5 + net/mpls/af_mpls.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 44 +- net/netfilter/ipvs/ip_vs_core.c | 1 + net/netfilter/ipvs/ip_vs_ctl.c | 77 ++- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 2 - net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 26 +- net/openvswitch/datapath.c | 54 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/flow.c | 28 +- net/openvswitch/meter.c | 33 +- net/openvswitch/vport.c | 6 +- net/packet/af_packet.c | 13 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/recv.c | 15 + net/rds/tcp.c | 14 +- net/sched/act_tunnel_key.c | 14 +- net/sched/cls_route.c | 35 +- net/sched/sch_cake.c | 1 - net/sctp/associola.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/input.c | 108 ++-- net/sctp/ipv6.c | 94 ++-- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 26 +- net/sctp/sm_statefuns.c | 8 +- net/sctp/stream.c | 6 +- net/smc/smc_core.c | 2 +- net/smc/smc_llc.c | 3 +- net/tipc/core.c | 5 + net/tipc/discover.c | 14 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/node.c | 15 +- net/tipc/socket.c | 3 +- net/tls/tls_sw.c | 19 +- net/vmw_vsock/virtio_transport.c | 3 +- net/wireless/nl80211.c | 4 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 4 +- security/integrity/ima/ima_appraise.c | 9 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/bt-sco.c | 18 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 35 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 23 +- sound/usb/midi.c | 2 + sound/usb/pcm.c | 7 + tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- 333 files changed, 3984 insertions(+), 1839 deletions(-)

2 months

Lists - Payment Advice

by lists.linaro.org Client Portal

DOC SWIFT_PAYMENT_MT103_01.pdf 672 KB ▼ DOC SWIFT_PAYMENT_MT103_02.pdf 629 KB ▼   DOC SWIFT_PAYMENT_MT103_03.pdf 615 KB ▼ DOC SWIFT_PAYMENT_MT103_04.pdf 655 KB ▼     ↑ 6 attachments (2.5 MB)   ▼ Download all Payment Notification Good day, Please be notified we have made payment for due invoices. Please Download the attached SWIFT COPIES. Thanks Accounts Department.

2 months, 1 week

[PATCH 7.1 000/438] 7.1.8-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.8 release. There are 438 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.8-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.8-rc1 Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Matthew Brost <matthew.brost(a)intel.com> drm/xe: Set TTM device beneficial_order to 9 (2M) Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Separate early xe_device initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.devid|revid initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.force_execlist initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Drop unused param from xe_device_create() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Alan Swanson <reiver(a)improbability.net> drm/amd/display: Silence link_dpms I2C retimer failures Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames George Zhang <george.zhang(a)amd.com> drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: check if dml21_add_phantom_plane() is successful Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: use milliwatts for GPU power sensors Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: hide pp_table sysfs on APUs Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Guangshuo Li <lgs201920130244(a)gmail.com> drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Close speculative mem read possibility Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Sasha Finkelstein <k(a)chaosmail.tech> power: supply: macsmc: Support macOS 27 SMC firmware Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Christian Loehle <christian.loehle(a)arm.com> cpufreq: cppc: Sanitize lockless policy limit snapshots Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Daniel Golle <daniel(a)makrotopia.org> gpiolib: tolerate gpio-hogs lacking a hogging state Hardik Prakash <hardikprakash.official(a)gmail.com> i2c: designware: defer probe if child GpioInt controllers are not bound Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Shawn Guo <shengchao.guo(a)oss.qualcomm.com> scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <dlemoal(a)kernel.org> scsi: libsas: terminate deferred commands on time out Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Jiakai Xu <xujiakai2025(a)iscas.ac.cn> riscv/mm: use physical alignment for vmemmap_start_pfn Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kyumin Lee <fyonglkm(a)gmail.com> io_uring: preserve task restrictions across exec Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: fix tid_tx use-after-free on BA session stop Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Soeren Moch <smoch(a)web.de> PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> fou: Fix use-after-free in fou_create() Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: schedule deferred atapi command Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Usama Arif <usama.arif(a)linux.dev> userfaultfd: wait on source PMD during UFFDIO_MOVE Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Stanislav Kinsburskii <skinsburskii(a)gmail.com> lib: test_hmm: use device devt for coherent device range selection Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Mykola Lysenko <nickolay.lysenko(a)gmail.com> btrfs: raid56: fix scrub read assembly submitting no reads Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Qi Zheng <qi.zheng(a)linux.dev> mm: mglru: fix stale batch updates after memcg reparenting Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Check all controls for fast switching Nicolas Schier <n.schier(a)fritz.com> kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Reject DMABUF pages from the access pin path Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Publish VP to pt_vp_array before installing the file descriptor Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix missing error code on VP allocation failure Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use memcmp() to compare ClientGUIDs Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: Return error code from mana_create_rxq() Long Li <longli(a)microsoft.com> net: mana: Create separate EQs for each vPort Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: Fix E2E delay mechanism Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> riscv: vdso: Only try to install vDSO when present Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> ipv6: release fib6_null_entry on subtree failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix reader page read offset for remote buffers Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/pt: check no-DMA huge-pte cases before DMA segment test Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Ao Sun <ao.sun(a)transsion.com> scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Block VFs from clobbering special CGX PKIND state Ratheesh Kannoth <rkannoth(a)marvell.com> octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_past_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Michael Bommarito <michael.bommarito(a)gmail.com> idpf: bound interrupt-vector register fill to the allocated array Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller David Howells <dhowells(a)redhat.com> netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Eric Joyner <eric.joyner(a)amd.com> ethtool: Embed FEC hist ranges as buffer in struct Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove Surendra Singh Chouhan <kr494167(a)gmail.com> ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Skip writes to unsupported performance controls Alex Tran <alex.tran(a)oss.qualcomm.com> gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper Gao Xiang <xiang(a)kernel.org> erofs: ensure valid f_path for page cache sharing Gao Xiang <xiang(a)kernel.org> erofs: remove fscache backend entirely Gao Xiang <xiang(a)kernel.org> erofs: clean up erofs_ishare_fill_inode() Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jonas Köppeler <j.koeppeler(a)tu-berlin.de> net/sched: sch_cake: skip clearing unused tins during rate adjustment Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: reclaim invalid Tx descriptors in ZC batch path Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: provide sufficient space in pool->tx_descs Jason Xing <kerneljasonxing(a)gmail.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kerneljasonxing(a)gmail.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: take nh->lock for f6i_list walks in replace check and notify Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Make UMP message size check more robust Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Always free firmware in FDL path Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Correct pointer passed to devm_acpi_table_put Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: clear the nfct flag under lock Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Julian Anastasov <ja(a)ssi.bg> ipvs: adjust double hashing when fwd method changes Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Add missing hyp_enter when trapping sysreg Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace clock disabling Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Mitigate potential LPI registration failure Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Fix race between LPI release and re-registration Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Yi Xie <xieyi(a)kylinos.cn> mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() Lorenzo Bianconi <lorenzo(a)kernel.org> selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Tomas Glozar <tglozar(a)redhat.com> rtla/timerlat_top: Fix on-threshold actions firing on signal Namjae Jeon <linkinjeon(a)kernel.org> ntfs: drop stale page-cache when shrinking a non-resident attr Namjae Jeon <linkinjeon(a)kernel.org> ntfs: harden runlist realloc size calculations Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: skip fully truncated ordered extents at zone finish Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Dongjiang Zhu <zhudongjiang(a)fnnas.com> btrfs: skip global block reserve accounting for rescue mounts Qu Wenruo <wqu(a)suse.com> btrfs: warn about extent buffer that can not be released Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Namjae Jeon <linkinjeon(a)kernel.org> ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix double free of wq, engine, and group structs Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable David Carlier <devnexen(a)gmail.com> dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold D Scott Phillips <scott(a)os.amperecomputing.com> KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Michael Diesen <michael.diesen(a)posteo.de> ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 4 + .../bindings/ufs/qcom,sa8255p-ufshc.yaml | 9 +- Documentation/filesystems/erofs.rst | 9 +- Documentation/networking/af_xdp.rst | 54 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 12 +- arch/arm64/include/asm/kvm_hypevents.h | 1 + arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 1 + arch/arm64/kvm/hyp_trace.c | 36 +- arch/arm64/kvm/mmu.c | 4 + arch/arm64/kvm/vgic/vgic-its.c | 25 +- arch/arm64/kvm/vgic/vgic-v3.c | 8 +- arch/arm64/kvm/vgic/vgic.c | 18 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/Makefile | 2 +- arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 7 +- arch/s390/kvm/pci.c | 107 +++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/amd.c | 4 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- arch/x86/kvm/x86.c | 6 + drivers/accel/qaic/qaic_control.c | 2 +- drivers/acpi/cppc_acpi.c | 29 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 37 +- drivers/ata/libata-sata.c | 2 +- drivers/ata/libata-scsi.c | 119 +++- drivers/ata/libata.h | 3 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 86 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/cppc_cpufreq.c | 35 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/idxd/init.c | 36 +- drivers/dma/sun6i-dma.c | 11 +- drivers/dma/switchtec_dma.c | 2 +- drivers/gpio/gpio-by-pinctrl.c | 18 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpio/gpiolib.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 ++++++-- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 ++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +- drivers/gpu/drm/amd/include/kgd_pp_interface.h | 6 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 39 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 29 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 5 +- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- .../drm/amd/pm/swsmu/smu11/cyan_skillfish_ppt.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 8 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_8_ppt.c | 3 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 + drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_hdmi_v2.c | 8 - drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/tests/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_device.c | 56 +- drivers/gpu/drm/xe/xe_device.h | 4 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pci.c | 15 +- drivers/gpu/drm/xe/xe_pt.c | 13 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 87 ++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hv/mshv_eventfd.c | 41 +- drivers/hv/mshv_irq.c | 2 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root_main.c | 41 +- drivers/hv/mshv_vtl_main.c | 1 + drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 61 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-designware-platdrv.c | 80 +++ drivers/i2c/busses/i2c-imx.c | 54 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- drivers/infiniband/hw/mana/main.c | 40 +- drivers/infiniband/hw/mana/mana_ib.h | 14 + drivers/infiniband/hw/mana/qp.c | 68 ++- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/pages.c | 3 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/rcar/rcar_canfd.c | 32 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 86 ++- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 + drivers/net/ethernet/intel/idpf/idpf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 12 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 97 ++- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 49 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 - drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 19 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 143 +++-- drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 23 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/pci/controller/dwc/pci-imx6.c | 9 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 +- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/macsmc-power.c | 52 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 ++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/libsas/sas_scsi_host.c | 15 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 9 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 26 +- drivers/spi/spi-nxp-fspi.c | 83 ++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufs-rpmb.c | 2 - drivers/ufs/core/ufshcd.c | 46 +- drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 54 +- fs/btrfs/block-group.c | 34 +- fs/btrfs/block-rsv.c | 19 +- fs/btrfs/disk-io.c | 58 +- fs/btrfs/extent_io.c | 6 - fs/btrfs/extent_io.h | 6 + fs/btrfs/fs.h | 9 + fs/btrfs/raid56.c | 15 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 27 +- fs/erofs/Kconfig | 36 +- fs/erofs/Makefile | 1 - fs/erofs/data.c | 4 +- fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 664 --------------------- fs/erofs/inode.c | 2 +- fs/erofs/internal.h | 76 +-- fs/erofs/ishare.c | 101 ++-- fs/erofs/super.c | 94 +-- fs/erofs/zdata.c | 6 - fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 10 +- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 + fs/netfs/objects.c | 30 +- fs/netfs/read_pgpriv2.c | 3 +- fs/netfs/rolling_buffer.c | 22 +- fs/netfs/write_issue.c | 15 +- fs/ntfs/attrib.c | 10 + fs/ntfs/namei.c | 3 +- fs/ntfs/runlist.c | 50 +- fs/ocfs2/dir.c | 5 +- fs/proc/task_mmu.c | 34 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 14 +- fs/smb/server/smb_common.c | 37 +- fs/smb/server/vfs_cache.c | 6 +- include/acpi/cppc_acpi.h | 5 +- include/drm/drm_exec.h | 20 +- include/hyperv/hvhdk_mini.h | 3 +- include/kvm/arm_vgic.h | 3 - include/linux/alloc_tag.h | 3 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/ethtool.h | 1 + include/linux/iommu.h | 5 + include/linux/libata.h | 6 +- include/linux/memcontrol.h | 25 + include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/netfs.h | 1 + include/linux/rolling_buffer.h | 6 +- include/linux/slab.h | 19 +- include/linux/thunderbolt.h | 3 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip_vs.h | 45 +- include/net/mana/mana.h | 15 +- include/net/netfilter/nf_conntrack_expect.h | 3 + include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 9 +- include/scsi/libsas.h | 3 +- io_uring/cancel.c | 2 +- io_uring/net.c | 1 + io_uring/tctx.c | 7 +- io_uring/tctx.h | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + lib/test_hmm.c | 2 +- mm/huge_memory.c | 14 +- mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 97 ++- mm/util.c | 2 +- mm/vmscan.c | 11 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 220 ++++--- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 273 ++++++--- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/can/isotp.c | 334 ++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 4 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/fou_core.c | 2 +- net/ipv4/netfilter/nf_nat_h323.c | 22 +- net/ipv4/nexthop.c | 25 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/agg-tx.c | 4 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 192 ++++-- net/netfilter/ipvs/ip_vs_core.c | 190 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_expect.c | 35 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 22 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/tcp.c | 8 +- net/sched/cls_u32.c | 7 + net/sched/sch_cake.c | 8 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 257 +++++++- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 65 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_device.c | 2 +- sound/soc/sdca/sdca_fdl.c | 5 +- sound/soc/sdca/sdca_functions.c | 2 + sound/soc/sdca/sdca_ump.c | 4 +- sound/soc/sophgo/cv1800b-sound-adc.c | 10 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 56 +- tools/testing/selftests/net/af_unix/.gitignore | 1 + tools/testing/selftests/net/af_unix/Makefile | 1 + tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++ .../selftests/net/netfilter/nft_flowtable.sh | 14 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- 455 files changed, 6043 insertions(+), 3365 deletions(-)

2 months, 1 week

[PATCH 6.18 000/396] 6.18.44-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.44 release. There are 396 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.44-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.44-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Oak Zeng <oak.zeng(a)intel.com> drm/xe: Add page reclamation info to device info Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Matthew Brost <matthew.brost(a)intel.com> drm/xe: Use SVM range helpers in PT layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/vm: Prevent binding of purged buffer objects Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support Xin Wang <x.wang(a)intel.com> drm/xe/pat: Add helper to query compression enable status Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Tejas Upadhyay <tejas.upadhyay(a)intel.com> drm/xe/guc: Fix buffer overflow in steered register list allocation Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 340 Loic Poulain <loic.poulain(a)oss.qualcomm.com> media: qcom: camss: csid-340: Fix unused variables Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Close the submit-side sock_hold race Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Wang Liang <wangliang74(a)huawei.com> net/handshake: Fix null-ptr-deref in handshake_complete() Christian Brauner <brauner(a)kernel.org> net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() Christian Brauner <brauner(a)kernel.org> file: ensure cleanup Christian Brauner <brauner(a)kernel.org> file: add FD_{ADD,PREPARE}() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Jinank Jain <jinankjain(a)microsoft.com> mshv: adjust interrupt control structure for ARM64 Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not updating BIS sender source address Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HCI: Add initial support for PAST Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jason Xing <kernelxing(a)tencent.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kernelxing(a)tencent.com> xsk: use a smaller new lock for shared pool case Jason Xing <kernelxing(a)tencent.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states Kuniyuki Iwashima <kuniyu(a)google.com> selftest: af_unix: Create its own .gitignore. Sunday Adelodun <adelodunolaoluwa(a)yahoo.com> selftests: af_unix: Add tests for ECONNRESET and EOF semantics John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Allocate the paravisor SynIC pages when required Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Rename fields for SynIC message and event pages Roman Kisel <romank(a)linux.microsoft.com> arch/x86: mshyperv: Discover Confidential VMBus availability Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Fabian Lippold <fabianlippold1184(a)gmail.com> ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 Honglei Huang <honghuan(a)amd.com> drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/hwmon/ina2xx.rst | 25 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 4 +- arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/mmu.c | 4 + arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 78 ++++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/mshyperv.c | 28 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +-- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 +++++++++++---- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 +++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 12 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +-- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpusvm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 12 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 ++ drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 ++- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 ++- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/xe_bo.h | 56 ++++ drivers/gpu/drm/xe/xe_bo_types.h | 6 + drivers/gpu/drm/xe/xe_device_types.h | 2 + drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_guc_capture.c | 11 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_migrate.c | 90 ++++-- drivers/gpu/drm/xe/xe_migrate.h | 4 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++++ drivers/gpu/drm/xe/xe_pagefault.h | 19 ++ drivers/gpu/drm/xe/xe_pagefault_types.h | 136 +++++++++ drivers/gpu/drm/xe/xe_pat.c | 6 + drivers/gpu/drm/xe/xe_pat.h | 10 + drivers/gpu/drm/xe/xe_pci.c | 1 + drivers/gpu/drm/xe/xe_pci_types.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 31 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 119 ++++++-- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 107 +++++-- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/channel_mgmt.c | 6 +- drivers/hv/hv.c | 206 +++++++------ drivers/hv/hyperv_vmbus.h | 22 +- drivers/hv/mshv_eventfd.c | 43 ++- drivers/hv/mshv_irq.c | 6 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root.h | 2 +- drivers/hv/mshv_root_hv_call.c | 6 + drivers/hv/mshv_root_main.c | 8 +- drivers/hv/mshv_synic.c | 6 +- drivers/hv/vmbus_drv.c | 19 +- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/adt7470.c | 131 +++++--- drivers/hwmon/ina2xx.c | 107 +++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 54 +++- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/media/platform/qcom/camss/camss-csid-340.c | 28 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 ++- drivers/net/can/usb/ems_usb.c | 43 +++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 ++- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 ++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 ++ drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +-- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 +++++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 ++- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 ++++++-- drivers/spi/spi-nxp-fspi.c | 83 ++++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 ++- drivers/ufs/core/ufshcd.c | 41 +-- drivers/usb/typec/ucsi/ucsi.c | 88 +++--- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 22 +- fs/btrfs/raid56.c | 4 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 17 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_pgpriv2.c | 1 + fs/netfs/write_issue.c | 7 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 10 +- fs/smb/server/smb_common.c | 37 ++- fs/smb/server/vfs_cache.c | 6 +- include/asm-generic/mshyperv.h | 2 + include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/hyperv/hvhdk.h | 6 + include/hyperv/hvhdk_mini.h | 3 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/cleanup.h | 7 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/file.h | 125 ++++++++ include/linux/iommu.h | 5 + include/linux/libata.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/userfaultfd_k.h | 5 +- include/net/bluetooth/hci.h | 54 ++++ include/net/bluetooth/hci_core.h | 12 + include/net/bluetooth/mgmt.h | 2 + include/net/ip_vs.h | 45 ++- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 13 +- include/scsi/libsas.h | 1 - include/uapi/linux/rkisp1-config.h | 6 +- io_uring/net.c | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + mm/huge_memory.c | 12 + mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 76 ++--- mm/util.c | 2 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_event.c | 79 ++++- net/bluetooth/hci_sync.c | 157 ++++++---- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 301 ++++++++++++------ net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 96 ++++-- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++++++++++------ net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/handshake/handshake-test.c | 8 + net/handshake/handshake.h | 2 + net/handshake/netlink.c | 54 ++-- net/handshake/request.c | 65 +++- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 ++++++----- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +--- net/netfilter/ipvs/ip_vs_xmit.c | 42 ++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +-- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 73 +++-- net/xdp/xsk_buff_pool.c | 3 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_functions.c | 2 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 38 ++- tools/testing/kunit/kunit_tool_test.py | 42 +++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/net/.gitignore | 7 - tools/testing/selftests/net/af_unix/.gitignore | 9 + tools/testing/selftests/net/af_unix/Makefile | 2 + .../testing/selftests/net/af_unix/unix_connreset.c | 177 +++++++++++ tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++++++++ tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- 402 files changed, 5655 insertions(+), 2209 deletions(-)

2 months, 1 week

[PATCH 6.12 000/337] 6.12.103-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.103 release. There are 337 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.103-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.103-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom David Howells <dhowells(a)redhat.com> rxrpc: Fix irq-disabled in local_bh_enable() David Howells <dhowells(a)redhat.com> rxrpc: Manage RTT per-call rather than per-peer David Howells <dhowells(a)redhat.com> rxrpc: Fix the calculation and use of RTO David Howells <dhowells(a)redhat.com> rxrpc: Adjust the rxrpc_rtt_rx tracepoint David Howells <dhowells(a)redhat.com> rxrpc: Generate rtt_min Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Skip inactive MST connectors when building stream list Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: Hold a dma-buf reference for imported BOs Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/xe: Rename ___xe_bo_create_locked() Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: give each kernel job a unique id Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/sched: Store the drm client_id in drm_sched_fence Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Breno Leitao <leitao(a)debian.org> mm/kmemleak: fix checksum computation for per-cpu objects Catalin Marinas <catalin.marinas(a)arm.com> kmemleak: iommu/iova: fix transient kmemleak false positive Geliang Tang <geliang(a)kernel.org> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: pm: use addr entry for get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <geliang(a)kernel.org> mptcp: pm: avoid code duplication to lookup endp Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Lucas De Marchi <lucas.demarchi(a)intel.com> drm/xe: Apply whitelist to engine save-restore Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Introduce xe_gt_dbg_printer() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Wandun Chen <chenwandun(a)lixiang.com> of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Zheng Yejian <zhengyejian(a)huaweicloud.com> tracing: Remove TRACE_EVENT_FL_FILTERED logic Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: add consts for irq index Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: support named IRQs Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Wenliang Yan <wenliang202407(a)163.com> hwmon: (ina226) Add support for SY24655 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for INA260 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for has_alerts configuration flag Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Oreoluwa Babatunde <quic_obabatun(a)quicinc.com> of: reserved_mem: Add code to dynamically allocate reserved_mem array Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Jakub Kicinski <kuba(a)kernel.org> netconsole: avoid OOB reads, msg is not nul-terminated Tristan Madani <tristan(a)talencesecurity.com> bpf: Reset register bounds before narrowing retval range in check_mem_access() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Wayen.Yan <win847(a)gmail.com> net: airoha: Fix register index for Tx-fwd counter configuration Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Tiwei Bie <tiwei.btw(a)antgroup.com> um: Preserve errno within signal handler Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for userspace process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for write_sigio thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for ubd io thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Use os_set_pdeathsig helper in winch thread/process Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for winch thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Add os_set_pdeathsig helper function Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/dev-tools/kmemleak.rst | 1 + Documentation/hwmon/ina2xx.rst | 67 +- Makefile | 4 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 28 +- arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/chan_user.c | 2 + arch/um/drivers/ubd_kern.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/um/include/shared/os.h | 2 + arch/um/os-Linux/process.c | 6 + arch/um/os-Linux/sigio.c | 1 + arch/um/os-Linux/signal.c | 3 + arch/um/os-Linux/skas/process.c | 3 + arch/x86/kvm/svm/avic.c | 8 - drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 +- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.h | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 40 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 12 +- drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 13 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 699 +++++++++++---------- drivers/gpu/drm/i915/display/intel_hdcp_gsc.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp_gsc.h | 5 +- .../gpu/drm/i915/display/intel_hdcp_gsc_message.h | 3 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/imagination/pvr_job.c | 2 +- drivers/gpu/drm/imagination/pvr_queue.c | 5 +- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/lima/lima_sched.c | 6 +- drivers/gpu/drm/lima/lima_sched.h | 3 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/msm/msm_gem_submit.c | 8 +- drivers/gpu/drm/nouveau/nouveau_sched.c | 3 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 3 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/panthor/panthor_mmu.c | 2 +- drivers/gpu/drm/panthor/panthor_sched.c | 5 +- drivers/gpu/drm/panthor/panthor_sched.h | 3 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/scheduler/sched_fence.c | 4 +- drivers/gpu/drm/scheduler/sched_main.c | 7 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/v3d/v3d_submit.c | 2 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 7 +- drivers/gpu/drm/xe/xe_bo.c | 33 +- drivers/gpu/drm/xe/xe_bo.h | 10 +- drivers/gpu/drm/xe/xe_bo_types.h | 2 + drivers/gpu/drm/xe/xe_dma_buf.c | 6 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt.c | 4 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_gt_printk.h | 31 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++ drivers/gpu/drm/xe/xe_pagefault.h | 19 + drivers/gpu/drm/xe/xe_pagefault_types.h | 136 ++++ drivers/gpu/drm/xe/xe_pt.c | 3 + drivers/gpu/drm/xe/xe_reg_sr.c | 53 -- drivers/gpu/drm/xe/xe_reg_whitelist.c | 147 ++++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_sched_job.c | 3 +- drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/Kconfig | 5 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 251 ++++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/iommu/iova.c | 6 + drivers/media/i2c/imx219.c | 31 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 +- drivers/net/ethernet/airoha/airoha_eth.c | 2 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 58 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 7 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/netconsole.c | 3 +- drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 15 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/of_reserved_mem.c | 87 ++- drivers/phy/xilinx/phy-zynqmp.c | 130 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 6 + drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 +++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/usb/gadget/function/f_tcm.c | 192 +++++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/binfmt_misc.c | 8 + fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 6 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/server/vfs_cache.c | 6 +- include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/drm/gpu_scheduler.h | 12 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/kmemleak.h | 4 + include/linux/libata.h | 2 +- include/linux/mmc/sdio_ids.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/trace_events.h | 4 - include/net/ip_vs.h | 45 +- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/scsi/libsas.h | 1 - include/trace/events/rxrpc.h | 14 +- include/uapi/linux/rkisp1-config.h | 6 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/verifier.c | 1 + kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/trace.c | 44 +- kernel/trace/trace.h | 4 - kernel/trace/trace_branch.c | 4 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_functions_graph.c | 8 +- kernel/trace/trace_hwlat.c | 4 +- kernel/trace/trace_mmiotrace.c | 21 +- kernel/trace/trace_osnoise.c | 12 +- kernel/trace/trace_probe.c | 6 +- kernel/trace/trace_sched_wakeup.c | 8 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + lib/test_fortify/Makefile | 1 + lib/win_minmax.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 12 +- mm/kmemleak.c | 44 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 34 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 154 +++-- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 113 ++-- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 ++- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/rxrpc/ar-internal.h | 38 +- net/rxrpc/call_accept.c | 1 + net/rxrpc/call_event.c | 19 +- net/rxrpc/call_object.c | 2 + net/rxrpc/input.c | 12 +- net/rxrpc/output.c | 14 +- net/rxrpc/peer_object.c | 20 +- net/rxrpc/proc.c | 6 +- net/rxrpc/rtt.c | 103 +-- net/rxrpc/sendmsg.c | 2 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/pci/hda/patch_hdmi.c | 48 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 39 +- tools/testing/kunit/kunit_tool_test.py | 42 ++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- 387 files changed, 4750 insertions(+), 2372 deletions(-) From gregkh(a)linuxfoundation.org Fri Aug 7 16:34:18 2026 Message-ID: <20260807143418.550667215(a)linuxfoundation.org> User-Agent: quilt/0.69 Date: Fri, 07 Aug 2026 16:34:19 +0200 From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> To: stable(a)vger.kernel.org Cc: patches(a)lists.linux.dev, linux-kernel(a)vger.kernel.org, torvalds(a)linux-foundation.org, akpm(a)linux-foundation.org, linux(a)roeck-us.net, shuah(a)kernel.org, patches(a)kernelci.org, lkft-triage(a)lists.linaro.org, pavel(a)nabladev.com, jonathanh(a)nvidia.com, f.fainelli(a)gmail.com, sudipm.mukherjee(a)gmail.com, rwarsow(a)gmx.de, conor(a)kernel.org, hargar(a)microsoft.com, broonie(a)kernel.org, achill(a)achill.org, sr(a)sladewatkins.com, Ilya Maximets <i.maximets(a)ovn.org>, Pablo Neira Ayuso <pablo(a)netfilter.org>, Sasha Levin <sashal(a)kernel.org> X-stable: review X-Patchwork-Hint: ignore Subject: [PATCH 6.12 001/337] netfilter: nf_conntrack_expect: restore helper propagation via expectation MIME-Version: 1.0 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso <pablo(a)netfilter.org> [ Upstream commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a ] A recent series to fix expectations broke helper propagation via expectation, this mechanism is used by the sip and h323 helper. This also propagates the conntrack helper to expected connections. I changed semantics of exp->helper which now tells us the actual helper that created the expectation. Add an explicit assign_helper field to expectations for this purpose and update helpers to use it. Restore this feature for userspace conntrack helper via ctnetlink nfqueue integration so it is again possible to attach a helper to an expectation, where it makes sense. This is not restored via ctnetlink expectation creation as there is no client for such feature. Use the expectation layer 4 protocol number for the helper lookup for consistency. Make sure the expectation using this helper propagation mechanism also go away when the helper is unregistered. Fixes: 9c42bc9db90a ("netfilter: nf_conntrack_expect: honor expectation helper field") Fixes: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations") Reported-by: Ilya Maximets <i.maximets(a)ovn.org> Tested-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/net/netfilter/nf_conntrack_expect.h | 5 ++++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +++++-- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 ++++++------ net/netfilter/nf_conntrack_helper.c | 5 +++++ net/netfilter/nf_conntrack_netlink.c | 18 ++++++++++++++++-- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 39 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h index e9a8350e7ccf..80f50fd0f7ad 100644 --- a/include/net/netfilter/nf_conntrack_expect.h +++ b/include/net/netfilter/nf_conntrack_expect.h @@ -45,9 +45,12 @@ struct nf_conntrack_expect { void (*expectfn)(struct nf_conn *new, struct nf_conntrack_expect *this); - /* Helper to assign to new connection */ + /* Helper that created this expectation */ struct nf_conntrack_helper __rcu *helper; + /* Helper to assign to new connection */ + struct nf_conntrack_helper __rcu *assign_helper; + /* The conntrack of the master connection */ struct nf_conn *master; diff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c index f9528d4db0a8..93c501d9d399 100644 --- a/net/netfilter/nf_conntrack_broadcast.c +++ b/net/netfilter/nf_conntrack_broadcast.c @@ -72,6 +72,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->flags = NF_CT_EXPECT_PERMANENT; exp->class = NF_CT_EXPECT_CLASS_DEFAULT; rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 423080cf86a4..0c457e159727 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1773,14 +1773,17 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl)); if (exp) { + struct nf_conntrack_helper *assign_helper; + /* Welcome, Mr. Bond. We've been expecting you... */ __set_bit(IPS_EXPECTED_BIT, &ct->status); /* exp->master safe, refcnt bumped in nf_ct_find_expectation */ ct->master = exp->master; - if (exp->helper) { + assign_helper = rcu_dereference(exp->assign_helper); + if (assign_helper) { help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); if (help) - rcu_assign_pointer(help->helper, exp->helper); + rcu_assign_pointer(help->helper, assign_helper); } #ifdef CONFIG_NF_CONNTRACK_MARK diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index bb8b87f9ee50..a8929885485b 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -344,6 +344,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, helper = rcu_dereference(help->helper); rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 791aafe9f396..c42547284f35 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, &nf_conntrack_helper_h245); + rcu_assign_pointer(exp->assign_helper, &nf_conntrack_helper_h245); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3 : NULL, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */ nathook = rcu_dereference(nfct_h323_nat_hook); @@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_UDP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_ras); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_ras); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect RAS "); @@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); @@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 9150bcfd7ca8..ea0cdb7ec915 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -419,6 +419,11 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) this = rcu_dereference_protected(exp->helper, lockdep_is_held(&nf_conntrack_expect_lock)); + if (this == me) + return true; + + this = rcu_dereference_protected(exp->assign_helper, + lockdep_is_held(&nf_conntrack_expect_lock)); return this == me; } diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index eacbbc342c3f..80fdb875c977 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -2630,6 +2630,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask); @@ -2856,6 +2857,7 @@ static int ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, u32 portid, u32 report) { + struct nf_conntrack_helper *assign_helper = NULL; struct nlattr *cda[CTA_EXPECT_MAX+1]; struct nf_conntrack_tuple tuple, mask; struct nf_conntrack_expect *exp; @@ -2871,8 +2873,18 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, if (err < 0) return err; + if (cda[CTA_EXPECT_HELP_NAME]) { + const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]); + + assign_helper = __nf_conntrack_helper_find(helpname, + nf_ct_l3num(ct), + tuple.dst.protonum); + if (!assign_helper) + return -EOPNOTSUPP; + } + exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct, - &tuple, &mask); + assign_helper, &tuple, &mask); if (IS_ERR(exp)) return PTR_ERR(exp); @@ -3511,6 +3523,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr, static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { @@ -3564,6 +3577,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->zone = ct->zone; #endif rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, assign_helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3; exp->mask.src.u.all = mask->src.u.all; @@ -3619,7 +3633,7 @@ ctnetlink_create_expect(struct net *net, ct = nf_ct_tuplehash_to_ctrack(h); rcu_read_lock(); - exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask); + exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask); if (IS_ERR(exp)) { err = PTR_ERR(exp); goto err_rcu; diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bd91b8b47f4b..852c0b74b8a7 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1386,7 +1386,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff, nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct), saddr, &daddr, proto, NULL, &port); exp->timeout.expires = sip_timeout * HZ; - rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, helper); exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE; hooks = rcu_dereference(nf_nat_sip_hooks); -- 2.53.0

2 months, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage August 2026