Lkft-triage September 2026

lkft-triage@lists.linaro.org

28 participants
27 discussions

[PATCH 5.10 000/798] 5.10.270-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.270 release. There are 798 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.270-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.270-rc1 Zhang Chen <zhangchen01(a)kylinos.cn> Bluetooth: L2CAP: Fix send LE flow credits in ACL link Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Handle %.*s in trace_check_vprintf() Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Have trace event string test handle zero length strings Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Dan Carpenter <dan.carpenter(a)linaro.org> HID: fix an error code in hid_check_device_match() Rafael Mendonca <rafaelmendsr(a)gmail.com> scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() Andy Shevchenko <andy.shevchenko(a)gmail.com> ACPI: utils: Document for_each_acpi_dev_match() macro Thomas Gleixner <tglx(a)linutronix.de> mm/highmem: Take kmap_high_get() properly into account Bjorn Andersson <bjorn.andersson(a)linaro.org> clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled Hui Tang <tanghui20(a)huawei.com> crypto: testmgr - fix initialization of 'secret_size' Hui Tang <tanghui20(a)huawei.com> crypto: ecdh - extend 'cra_driver_name' with curve name Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> driver core: platform: don't oops in platform_shutdown() on unbound devices Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix corruption of urgent data on multi-segment retransmit Deepanshu Kartikey <kartikey406(a)gmail.com> usb: atm: usbatm: fix invalid ci_range initialization bui duc phuc <phucduc.bui(a)gmail.com> net: fec: only stop PTP if it was initialized Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: selftests: Account for the UC filter list for filtering tests Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: dwmac4: Account for the primary MAC address for UC filtering Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: stmmac: selftests: Check multiple MMC counters Muhammad Usama Anjum <usama.anjum(a)arm.com> selftests/arm64: Treat KSM merge_across_nodes as optional Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() Marino Dzalto <marino.dzalto(a)gmail.com> netfilter: xt_HL: add pr_fmt and checkentry validation Michal Koutný <mkoutny(a)suse.com> netfilter: xt_cgroup: Make it independent from net_cls Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: move hardware offload step after building the chain blob bui duc phuc <phucduc.bui(a)gmail.com> net: ethernet: sun4i-emac: Fix IRQ error handling HyeongJun An <sammiee5311(a)gmail.com> ASoC: dapm: Fix off-by-one check on the second enum channel John Johansen <john.johansen(a)canonical.com> apparmor: policy_int make sure list heads are initialized before fail path Thorsten Blum <thorsten.blum(a)linux.dev> apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init Ruoyu Wang <ruoyuw560(a)gmail.com> tpm: st33zp24: Validate locality read result Ruoyu Wang <ruoyuw560(a)gmail.com> tpm: st33zp24: Return zero on status read failure Victor Nogueira <victor(a)mojatatu.com> net/sched: sch_teql: restore skb->dev on the slave failure path Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sfq: clamp quantum to avoid signed overflow soft lockup Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: hhf: clamp quantum before hhf_change() to avoid overflow Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fq_pie: clamp default quantum to avoid signed overflow Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_codel: clamp default mtu to avoid disabling CoDel Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: fq_codel: clamp default quantum and mtu Eric Dumazet <edumazet(a)google.com> net_sched: export pfifo_fast prio2band[] Eric Dumazet <edumazet(a)google.com> net_sched: sch_fq: change how @inactive is tracked Eric Dumazet <edumazet(a)google.com> net_sched: sch_fq: struct sched_data reorg Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() Frank Sorenson <sorenson(a)redhat.com> cifs: fix clearing stats for fastest execution of each smb2 command Allison Henderson <achender(a)kernel.org> net/rds: use wq_has_sleeper() in rds_cong_map_updated() Xiang Mei <xmei5(a)asu.edu> net: qualcomm: rmnet: restore skb->dev on deaggregated frames Cen Zhang (Microsoft) <blbllhy(a)gmail.com> gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop Chris Lu <chris.lu(a)mediatek.com> Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX Pauli Virtanen <pav(a)iki.fi> Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister Edward Adam Davis <eadavis(a)qq.com> bluetooth/l2cap: sync sock recv cb and release Sebastian Urban <surban(a)surban.net> Bluetooth: compute LE flow credits based on recvbuf space Dan Carpenter <error27(a)gmail.com> scsi: qla2xxx: Fix an loop timeout test Junrui Luo <moonafterrain(a)outlook.com> NFSv4/pnfs: key the data server cache on the NFS version Jeff Layton <jlayton(a)kernel.org> nfs: move the nfs4_data_server_cache into struct nfs_net Junrui Luo <moonafterrain(a)outlook.com> NFSv4.2: fix LAYOUTSTATS send buffer exhaustion Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: free pending qentry in smc_llc_flow_stop() before memset Marek Czernohous <marek(a)czernohous.de> forcedeth: stop the tx_timeout register dump past the requested window Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Count delivered packets in rx_packets and rx_bytes Ruoyu Wang <ruoyuw560(a)gmail.com> net: bridge: Reject descending VLAN tunnel ranges Serhat Kumral <serhatkumral1(a)gmail.com> RDMA/ucma: Allow path records to exactly fit the output buffer Bradley Morgan <include(a)grrlz.net> prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator Yi Ding <yi.s.ding(a)gmail.com> rtc: pcf8563: fix clock provider leak on unbind Li RongQing <lirongqing(a)baidu.com> vdpa/mlx5: fix wrong list iterated in add_direct_chain error path Michael S. Tsirkin <mst(a)redhat.com> virtio_balloon: disable indirect descriptors Ruoyu Wang <ruoyuw560(a)gmail.com> bonding: initialize err for empty target lists Nguyen Dinh Phi <phind.uet(a)gmail.com> vsock: use sock_error() to consume sk_err after a failed connect Karl Mehltretter <kmehltretter(a)gmail.com> 8139cp: fix Rx and Tx not being disabled in cp_suspend Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix connection list comparison in proc output Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix inverted default vlan notification Joas Antonio dos Santos <joasantonio108(a)gmail.com> ipvs: fix integer overflow in ftp helper port/address parsing Lukasz Majewski <lukma(a)denx.de> net: hsr: Use full string description when opening HSR network device Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> hsr: Use a single struct for self_node. Qingfang Deng <qingfang.deng(a)linux.dev> pppox: drain queued packets on channel handoff Junseo Lim <zirajs7(a)gmail.com> net: kcm: Hold RCU read lock while running BPF parser Ruoyu Wang <ruoyuw560(a)gmail.com> NFSv4: remove callback IDR entry on client allocation failure Arnaud Bonnet <abo(a)medichon.fr> nfs: refactor pNFS functions using clear_and_wake_up_bit Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4/pnfs: Clean up layout get on open Arnaud Bonnet <abo(a)medichon.fr> nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Always clear an invalid mapping when attempting a buffered write Junseo Lim <zirajs7(a)gmail.com> bpf: Reject negative optlen in cgroup getsockopt hook Junseo Lim <zirajs7(a)gmail.com> lwt_bpf: Restore reserved headroom after xmit program Delphine CC Chiu <Delphine_CC_Chiu(a)wiwynn.com> hwmon: (emc1403) Add support for EMC1442 Linmao Li <lilinmao(a)kylinos.cn> mailbox: rockchip: disable pclk on probe failure and unbind Arnaldo Carvalho de Melo <acme(a)redhat.com> perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() Arnaldo Carvalho de Melo <acme(a)redhat.com> perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() Israel Téllez García <i.tellez(a)btesa.com> bpf: Fix pending_pos walk on 32-bit ring position wrap Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Have TRACE_DEFINE_ENUM affect trace event types as well Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Add DYNAMIC flag for dynamic events Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Add a verifier to check string pointers for trace events Steven Rostedt (VMware) <rostedt(a)goodmis.org> seq_buf: Add seq_buf_terminate() API Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers Phillip Lougher <phillip(a)squashfs.org.uk> Squashfs: check block offset is not negative Krystian Kaniewski <krystianmkaniewski(a)gmail.com> ocfs2: fix circular locking dependency in ocfs2_init_acl() Yuan Chen <chenyuan(a)kylinos.cn> bpftool: Fix double close in map dump Bijan Tabatabai <btabatabai(a)wisc.edu> x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported Yuho Choi <dbgh9129(a)gmail.com> clocksource/drivers/armada: Unwind timer clock on init failure Guangshuo Li <lgs201920130244(a)gmail.com> clocksource/drivers/clps711x: Do not unmap clocksource MMIO Yuho Choi <dbgh9129(a)gmail.com> xenbus: Unregister reboot notifier on init failure Henrik Grimler <henrik.grimler(a)axis.com> power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address Henrik Grimler <henrik.grimler(a)axis.com> power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address Henrik Grimler <henrik.grimler(a)axis.com> power: supply: bq27xxx: bq27520g4: fix REG_TTES address Matti Vaittinen <mazziesaccount(a)gmail.com> power: supply: bd99954: Drop bad register fields Felix Gu <ustc.gu(a)gmail.com> spi: img-spfi: don't disable runtime PM on DMA deferred probe Ran Hongyun <ranhongyun1(a)huawei.com> UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: fix stream_data leak on open error Yuho Choi <dbgh9129(a)gmail.com> ubi: Fix rollback for explicit UBI device numbers Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Add module parameter to control reserving filling pool PEBs Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Wait until there are enough free PEBs before filling pools Yang Li <yang.lee(a)linux.alibaba.com> ubi: Simplify bool conversion ZhaoLong Wang <wangzhaolong1(a)huawei.com> ubi: fastmap: Add fastmap control support for module parameter Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl Zhihao Cheng <chengzhihao1(a)huawei.com> UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs Zhihao Cheng <chengzhihao1(a)huawei.com> UBI: Preserve torture flag when rescheduling failed erasures Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: Replace erase_block() with sync_erase() Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: fastmap: Fix missed ec updating after erasing old fastmap data block Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ubi: fastmap: Use the bitmap API to allocate bitmaps Jilin Yuan <yuanjilin(a)cdjrlc.com> ubi: Fix repeated words in comments LiangCheng Wang <zaq14760(a)gmail.com> ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready bui duc phuc <phucduc.bui(a)gmail.com> ASoC: pxa: Use devm_clk_get_optional() for extclk clock Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/cma: Fix WARNING in res_to_rt Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Free debugfs on registration failure Guangshuo Li <lgs201920130244(a)gmail.com> dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal Linmao Li <lilinmao(a)kylinos.cn> nfc: digital: Do not dump a NULL response in command completion Yinhao Hu <dddddd(a)hust.edu.cn> nfc: pn533: hold a reference to the request skb during send_frame Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound SNL TLV parsing to the skb and add length checks Zhenghang Xiao <kipreyyy(a)gmail.com> nfc: nci: fix double completion race in nci_data_exchange_complete Breno Leitao <leitao(a)debian.org> nfc: llcp: read llcp_sock->local under the socket lock in getsockopt Breno Leitao <leitao(a)debian.org> nfc: llcp: avoid userspace overflow on invalid optlen Babanpreet Singh <bbnpreetsingh(a)gmail.com> spi: sprd-adi: Fix probe succeeding without registering the controller Michael Walle <mwalle(a)kernel.org> powerpc/configs: enable CONFIG_RAS to fix EDAC support Weiming Shi <bestswngs(a)gmail.com> SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 Karl Mehltretter <kmehltretter(a)gmail.com> m68k: Fix backtraces for non-running tasks Desnes Nunes <desnesn(a)redhat.com> iommu/vt-d: Fix UCTP context table slot when copying root entries Danila Chernetsov <listdansp(a)mail.ru> fbdev: kyro: Validate overlay viewport coordinates Ian Rogers <irogers(a)google.com> perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers <irogers(a)google.com> perf synthetic-events: Fix uninitialized pthread_join Ian Rogers <irogers(a)google.com> perf stat: Fix evsel_list leak in cmd_stat Namhyung Kim <namhyung(a)kernel.org> perf stat: Clear screen only if output file is a tty Rosen Penev <rosenp(a)gmail.com> ARM: dts: helios4: add SATA regulator supplies Rosen Penev <rosenp(a)gmail.com> ARM: dts: helios4: add vcc-supply to GPIO expander Rosen Penev <rosenp(a)gmail.com> ARM: dts: helios4: add vcc-supply to EEPROM Tomáš Macholda <tomas.macholda(a)nic.cz> arm64: dts: turris-mox: fix usb3 phys Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: gp2ap002: re-enable irq if runtime suspend fails Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MSFT: validate evt_prefix_len against the response length Tanushree Shah <tshah(a)linux.ibm.com> perf trace-event: Fix integer truncation in do_read() and skip() Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> sched/fair: Check CPU capacity before comparing group types during load balance Valentin Schneider <valentin.schneider(a)arm.com> sched/fair: Introduce a CPU capacity comparison helper Kamal Wadhwa <kamal.wadhwa(a)oss.qualcomm.com> regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling Loic Poulain <loic.poulain(a)oss.qualcomm.com> phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Yichong Chen <chenyichong(a)uniontech.com> hugetlbfs: release subpool on fill_super failure Simon Glass <sjg(a)chromium.org> pinctrl: rockchip: Reset the pin count when recalculating SoC data Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> firmware_loader: do not queue completed sysfs fallback requests Russ Weight <russell.h.weight(a)intel.com> firmware_loader: Check fw_state_is_done in loading_store Manish Rangankar <mrangankar(a)marvell.com> scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Use PFP on the compute queues too Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets Tanushree Shah <tshah(a)linux.ibm.com> perf trace-event: Fix buffer overflow in read_string() Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/gfx6: Fixup emit_cntxcntl() Pengpeng Hou <pengpeng(a)iscas.ac.cn> mfd: iqs62x: Reject zero-length firmware records Pengpeng Hou <pengpeng(a)iscas.ac.cn> mfd: rave-sp: validate received frame payload lengths Vladimir Murzin <vladimir.murzin(a)arm.com> arm64: hibernate: Restore DAIF state on error Ada Couprie Diaz <ada.coupriediaz(a)arm.com> arm64: hibernate: mask DAIF before restoring hibernated kernel Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> RDMA/siw: Fix use-after-free in siw_accept() Guoqing Jiang <guoqing.jiang(a)linux.dev> RDMA/siw: Introduce siw_free_cm_id Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> IB/isert: post the full-feature receive buffers after session registration Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> IB/isert: delay the final Login Response until the session is registered Karl Mehltretter <kmehltretter(a)gmail.com> cpufreq: imx6q: fix out-of-bounds write when probed more than once Karl Mehltretter <kmehltretter(a)gmail.com> cpufreq: imx6q: fix devres accumulation across driver rebind Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: dw-hdmi: Drop TCON TOP port reference Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: tcon: Drop remote endpoint reference Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: crtc: Propagate layer initialization error Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: tcon: Drop TCON TOP device reference Geert Uytterhoeven <geert+renesas(a)glider.be> bitfield: Add non-constant field_{prep,get}() helpers Geert Uytterhoeven <geert+renesas(a)glider.be> bitfield: Add less-checking __FIELD_{GET,PREP}() Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> of: property: use unsigned int return on of_graph_get_endpoint_count() Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> of: property: add missing kerneldoc for of_graph_get_endpoint_count() Jernej Skrabec <jernej.skrabec(a)gmail.com> drm/sun4i: vi scaler: Fix coefficient selection Cen Zhang <zzzccc427(a)gmail.com> ocfs2: synchronize heartbeat callbacks with o2net teardown Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: use bitmap API in fill_node_map Xie Yuanbin <xieyuanbin1(a)huawei.com> ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ Sergei Litvin <litvindev(a)gmail.com> scripts/tags.sh: Prevent binary files appearing in cscope.files Jialu Xu <xujialu(a)vimux.org> scripts/tags.sh: improve compiled sources generation Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: Move resource table data structure to its own header Suman Anna <s-anna(a)ti.com> remoteproc: Fix various kernel-doc warnings Mathieu Poirier <mathieu.poirier(a)linaro.org> remoteproc: Introduce function rproc_detach() Mathieu Poirier <mathieu.poirier(a)linaro.org> remoteproc: Introduce function __rproc_detach() Mathieu Poirier <mathieu.poirier(a)linaro.org> remoteproc: Add new detach() remoteproc operation Suman Anna <s-anna(a)ti.com> remoteproc: Add a rproc_set_firmware() API Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Add static PCI resource attribute macros Yichong Chen <chenyichong(a)uniontech.com> fat: release buffer head after rebuilding parent Guangshuo Li <lgs201920130244(a)gmail.com> rapidio: clear mport->net when rio_add_net() fails Calvin Owens <calvin(a)wbinvd.org> pps: don't try to wait for negative timeouts in PPS_FETCH Bradley Morgan <include(a)grrlz.net> lib/string: fix memchr_inv() for large ranges Tao Cui <cuitao(a)kylinos.cn> block/kyber-iosched: flush per-cpu latency buckets over possible CPUs Tao Cui <cuitao(a)kylinos.cn> block/blk-iocost: collect per-cpu latency stats over possible CPUs Tao Cui <cuitao(a)kylinos.cn> block/blk-stat: drain per-cpu callback stats over possible CPUs Breno Leitao <leitao(a)debian.org> phonet: pep: do not write beyond optlen in getsockopt Sang-Heon Jeon <ekffu200098(a)gmail.com> iio: light: tsl2583: return zero in write_raw() on success Sang-Heon Jeon <ekffu200098(a)gmail.com> iio: light: isl29028: return zero in write_raw() on success Yuanshen Cao <alex.caoys(a)gmail.com> iio: light: tsl2772: fix ALS calibscale readback Arnaldo Carvalho de Melo <acme(a)redhat.com> perf intel-bts: Fix off-by-one in auxtrace_info minimum size check Arnaldo Carvalho de Melo <acme(a)redhat.com> perf intel-pt: Fix off-by-one in auxtrace_info minimum size check Arnaldo Carvalho de Melo <acme(a)redhat.com> perf auxtrace: Fix queue grow overflow and old array leak Arnaldo Carvalho de Melo <acme(a)redhat.com> perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Jiancheng Huang <jchuang(a)seu.edu.cn> HID: lg4ff: validate report length before fixed offsets Ai Chao <aichao(a)kylinos.cn> HID: i2c-hid: Fix "(null)" output when reading report descriptor fails Hans de Goede <hdegoede(a)redhat.com> HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling Yousef Alhouseen <alhouseenyousef(a)gmail.com> HID: synchronize input before cleaning up a failed probe Dmitry Torokhov <dmitry.torokhov(a)gmail.com> HID: ensure timely release of driver-allocated resources Dmitry Torokhov <dmitry.torokhov(a)gmail.com> HID: split apart hid_device_probe to make logic more apparent Karl Mehltretter <kmehltretter(a)gmail.com> tty: clear cdev pointer after cdev_add() failure Karl Mehltretter <kmehltretter(a)gmail.com> serial: amba-pl011: unprepare console clock on unregister Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL Gou Hao <gouhao(a)uniontech.com> powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> firmware: coreboot: Validate table bounds Titouan Ameline de Cadeville <titouan.ameline(a)gmail.com> firmware: google: Add bounds checks in coreboot_table_populate() Kees Cook <keescook(a)chromium.org> firmware: coreboot: Check size of table entry and use flex-array Philipp Borgers <borgers(a)mi.fu-berlin.de> mac80211: add ieee80211_is_tx_data helper function Slawomir Stepien <sst(a)poczta.fm> wifi: zd1211rw: reject secondary interfaces to prevent conflicts Pranjal Shrivastava <praan(a)google.com> iommu/arm-smmu-v3: Convert to use atomic poll timeout Linghui Wu <linghui.wu(a)oss.qualcomm.com> wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Check snprintf truncation for guest kallsyms path Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Free scandir entries in guest kernel map creation Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Reset errno before strtol in guest kernel map creation Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Don't abort guest map creation on first inaccessible dir Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Check snprintf truncation in machines__findnew() Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Use snprintf() for guestmount path construction Arnaldo Carvalho de Melo <acme(a)redhat.com> perf machine: Guard against NULL strlist in machines__findnew() Joy Zou <joy.zou(a)oss.nxp.com> regulator: core: use system_freezable_wq for init complete work Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> wifi: ath11k: fix leak in ath11k_service_ready_ext_event() Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> drm/msm/dsi: Drop dev_pm_opp_set_rate(0) Leo Yan <leo.yan(a)arm.com> perf: arm_spe: Make wakeup range check overflow safe Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length Yichong Chen <chenyichong(a)uniontech.com> fanotify: report full event length for FIONREAD Abdun Nihaal <nihaal(a)cse.iitm.ac.in> misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() Naveen Kumar Chaudhary <naveen.osdev(a)gmail.com> locking/lockdep: Fix NULL pointer dereference in __lock_set_class() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix device_register() error path Jakub Kicinski <kuba(a)kernel.org> i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Aneesh Kumar K.V (Arm) <aneesh.kumar(a)kernel.org> iommu/dma: Check atomic pool allocation result directly Vladimir Zapolskiy <vz(a)kernel.org> clk: qcom: Return expected ENOMEM error on dynamic allocation failure Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone Pu Lehui <pulehui(a)huawei.com> bpf: Fix potential UAF in bpf_netns_link_update_prog Hongyan Xu <getshell(a)seu.edu.cn> power: supply: sc2731_charger: cancel work on remove Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> power: supply: sc2731_charger: Convert to platform remove callback returning void Hongyan Xu <getshell(a)seu.edu.cn> power: supply: isp1704_charger: cancel work on remove Cheng-Han Wu <hank20010209(a)gmail.com> selftests/zram: fix kernel_gte() for POSIX sh Sajal Gupta <sajal2005gupta(a)gmail.com> md/raid5-ppl: fix use-after-free in ppl_do_flush() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: pci: fix error path in rtl_pci_probe() Guixin Liu <kanie(a)linux.alibaba.com> nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> IB/isert: reject login PDUs declaring more data than was received Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> IB/isert: reject PDUs declaring more data than was received Leon Romanovsky <leon(a)kernel.org> RDMA/cxgb4: free STAG index when TPT entry write fails Leon Romanovsky <leon(a)kernel.org> RDMA/mlx5: Send cong param changes to the resolved port mdev Leon Romanovsky <leon(a)kernel.org> RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs David Lee <david.lee(a)trailofbits.com> nilfs2: prevent out-of-bounds read in super root block parsing Joshua Crofts <joshua.crofts1(a)gmail.com> nilfs2: fix infinite loop in nilfs_clean_segments() longlong yan <yanlonglong(a)kylinos.cn> clk/x86: pmc_atom: add kasprintf return value check Myeonghun Pak <mhun512(a)gmail.com> clk: palmas: Manage external-control prepare with devm Guangshuo Li <lgs201920130244(a)gmail.com> clk: tegra: tegra124-emc: put EMC node on register failure Ondrej Jirman <megi(a)xff.cz> arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Fix PBL chunk length computation Ivy Lopez <skunkolee(a)gmail.com> staging: rtl8723bs: use kfree_sensitive() for key material Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> remoteproc: Prevent crash handling to race with rproc_del() Jingyi Wang <jingyi.wang(a)oss.qualcomm.com> remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: Use unbounded workqueue for recovery work Alex Elder <elder(a)linaro.org> remoteproc: use freezable workqueue for crash notifications Mathieu Poirier <mathieu.poirier(a)linaro.org> remoteproc: Add new RPROC_ATTACHED state Mathieu Poirier <mathieu.poirier(a)linaro.org> remoteproc: Remove useless check in rproc_del() Babanpreet Singh <bbnpreetsingh(a)gmail.com> w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Yichong Chen <chenyichong(a)uniontech.com> isofs: release zisofs block pointer buffer head Maher Sanalla <msanalla(a)nvidia.com> RDMA/mlx5: Fix integer overflow of user QP buffer size Babanpreet Singh <bbnpreetsingh(a)gmail.com> power: supply: sbs-battery: Use a per-device serial number buffer Ikjoon Jang <ikjn(a)chromium.org> power: supply: sbs-battery: cache constant string properties Karl Mehltretter <kmehltretter(a)gmail.com> ARM: lpc32xx: only run SoC init on LPC32xx hardware Fabio Estevam <festevam(a)gmail.com> arm64: dts: rockchip: Fix Gru WLAN sideband interrupt Rob Herring <robh(a)kernel.org> arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru Chen-Yu Tsai <wenst(a)chromium.org> arm64: dts: rockchip: Add gru-scarlet-dumo board Florian Westphal <fw(a)strlen.de> netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Can Peng <pengcan(a)kylinos.cn> drm/tve200: add OF module alias for autoloading Cosmo Chou <chou.cosmo(a)gmail.com> leds: pca9532: Fix phantom device registration on missing hardware Leo Yan <leo.yan(a)arm.com> perf cs-etm: Avoid truncating AUX buffer sizes to int Leo Yan <leo.yan(a)arm.com> perf cs-etm: Flush thread stacks after decoder reset Andre Przywara <andre.przywara(a)arm.com> ARM: dts: allwinner: a10: Fix PMU interrupt Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Venkateswara Naralasetty <quic_vnaralas(a)quicinc.com> ath11k: add trace log support Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> wifi: ath11k: Correctly copy the hint BSSID in WMI scan request Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> wifi: ath6kl: avoid buffer overreads in WMI event handlers Baokun Li <libaokun(a)linux.alibaba.com> ext4: drain in-flight DIO before buffered write fallback Pengpeng Hou <pengpeng(a)iscas.ac.cn> thermal: intel: int3400: clean up ODVP on probe failures Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: int340x_thermal: Consolidate priv->data_vault checks Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() Haoxiang Li <haoxiang_li2024(a)163.com> iommu/qcom: Remove sysfs device on probe failure path Miaoqian Lin <linmq006(a)gmail.com> iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> RDMA/restrack: Fix typos in the comments Leon Romanovsky <leon(a)kernel.org> RDMA/srpt: Pass the mapped task attribute to target_init_cmd() Mike Christie <michael.christie(a)oracle.com> scsi: target: srpt: Convert to new submission API Mike Christie <michael.christie(a)oracle.com> scsi: target: core: Break up target_submit_cmd_map_sgls() Mike Christie <michael.christie(a)oracle.com> scsi: target: core: Rename transport_init_se_cmd() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls() Mike Christie <michael.christie(a)oracle.com> scsi: qla2xxx: Move sess cmd list/lock to driver Mike Christie <michael.christie(a)oracle.com> scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG Mike Christie <michael.christie(a)oracle.com> scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG Yun Zhou <yun.zhou(a)windriver.com> ext4: skip extra isize expansion during mount to prevent deadlock Chen Pei <cp0613(a)linux.alibaba.com> ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root Pengpeng Hou <pengpeng(a)iscas.ac.cn> ACPI: processor: validate MADT IOAPIC entry bounds Kemeng Shi <shikemeng(a)huaweicloud.com> irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() TanZheng <tanzheng(a)kylinos.cn> RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters Danila Chernetsov <listdansp(a)mail.ru> RDMA/hfi1: Propagate sdma_txinit_ahg() errors Linmao Li <lilinmao(a)kylinos.cn> ASoC: meson: Keep link pointers valid on realloc failure Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Clear stale requests on termination Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Serialize channel state checks Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Serialize abort state updates Yuho Choi <dbgh9129(a)gmail.com> driver core: soc: Unregister bus on early device registration failure Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> driver core: soc: remove layering violation for the soc_bus Alban Bedel <alban.bedel(a)lht.dlh.de> software node: Fix software_node_get_reference_args() with index -1 Ian Rogers <irogers(a)google.com> perf ui hists: Fix uninitialized stack memory free on pstack allocation failure zhouminqiang <zhouminqiang2(a)huawei.com> mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Ruoyu Wang <ruoyuw560(a)gmail.com> mtd: mtdswap: Avoid freeing registered blktrans device twice Pengpeng Hou <pengpeng(a)iscas.ac.cn> soc: ti: knav_qmss: Remove debugfs file on teardown Md Shofiqul Islam <shofiqtest(a)gmail.com> soc: ti: knav_qmss_queue: Implement resource cleanup in remove() Xiang Mei <xmei5(a)asu.edu> vfio/pci: clear vdev->msi_perm after freeing it on init failure Myeonghun Pak <mhun512(a)gmail.com> char: xilinx_hwicap: unregister class on init errors Linmao Li <lilinmao(a)kylinos.cn> ppdev: prevent overflow when setting port timeout Pengpeng Hou <pengpeng(a)iscas.ac.cn> misc: ad525x_dpot: use driver core groups for sysfs files Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> misc: ad525x_dpot: Make ad_dpot_remove() return void Gleb Markov <markov.gi(a)npc-ksb.ru> misc: rtsx: add missing write register handling Pavel Zhigulin <Pavel.Zhigulin(a)kaspersky.com> speakup: keyhelp: guard letter_offsets possible out-of-range indexing Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() Yuho Choi <dbgh9129(a)gmail.com> uio: Fix stale info pointer in failed registration path David Lee <david.lee(a)trailofbits.com> UDF symlink pathComponent header OOB read Karl Mehltretter <kmehltretter(a)gmail.com> tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 Xu Yang <xu.yang_2(a)nxp.com> usb: gadget: f_uac1_legacy: remove broken string configfs attributes Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: processor: idle: Expand _LPI package sanity checks Wolfram Sang <wsa+renesas(a)sang-engineering.com> ACPI: move from strlcpy() with unused retval to strscpy() Daniel Scally <djrscally(a)gmail.com> media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Avoid stack over-read in debug output helpers Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix offset calculation in trace_write_gather Maoyi Xie <maoyixie.tju(a)gmail.com> drm/bridge: tc358767: clamp the reported AUX read size to the request Uday Khare <udaykhare77(a)gmail.com> remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: schedutil: Add util to struct sg_cpu Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate() Herve Codina <herve.codina(a)bootlin.com> irqdomain: Handle additional domain flags in irq_domain_instantiate() Herve Codina <herve.codina(a)bootlin.com> irqdomain: Introduce irq_domain_instantiate() Dan Carpenter <error27(a)gmail.com> cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Bound the on-media label size before the shift Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate Kyle Zeng <kylebot(a)openai.com> hfsplus: validate thread record before delete key rebuild Vishnu Santhosh <vishnu.santhosh(a)oss.qualcomm.com> rpmsg: glink: fix deadlock in endpoint destroy during driver detach Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> rpmsg: glink: remove duplicate code for rpmsg device remove Arun Kumar Neelakantam <aneela(a)codeaurora.org> rpmsg: glink: Remove the rpmsg dev in close_ack Ira Weiny <ira.weiny(a)intel.com> iov_iter: lift memzero_page() to highmem.h Thomas Gleixner <tglx(a)linutronix.de> highmem: Provide generic variant of kmap_atomic* Leon Romanovsky <leon(a)kernel.org> RDMA/hfi1: Initialize debugfs after probe completes Leon Romanovsky <leon(a)kernel.org> RDMA/hfi1: Stop flushing the global IB workqueue Leon Romanovsky <leon(a)kernel.org> RDMA/hfi1: Create workqueues before device initialization Leon Romanovsky <leon(a)kernel.org> RDMA/hfi1: Remove redundant PCI device ID validation Leon Romanovsky <leon(a)kernel.org> RDMA/hfi1: Preserve unit 0 on allocation failure Sean Rhodes <sean(a)starlabs.systems> misc: rtsx_usb: avoid USB I/O in runtime autosuspend Pengpeng Hou <pengpeng(a)iscas.ac.cn> pmdomain: bcm: bcm2835: handle genpd provider registration errors Evgenii Burenchev <evg28bur(a)yandex.ru> ALSA: hpi: Check transport errors during HPI6000 adapter initialization Xiang Mei <xmei5(a)asu.edu> xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Yuho Choi <dbgh9129(a)gmail.com> hwrng: ks-sa - Fix runtime PM cleanup on registration failure Martin Kaiser <martin(a)kaiser.cx> hwrng: ks-sa - access private data via struct hwrng Leon Romanovsky <leon(a)kernel.org> RDMA/ipoib: Drain RCU callbacks during module teardown Leon Romanovsky <leon(a)kernel.org> RDMA/core: Wait for RCU callbacks before unloading ib_core Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage Mert Seftali <mertsftl(a)gmail.com> iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> drm/panel: samsung-s6d16d0: Power off on prepare failure Biju Das <biju.das.jz(a)bp.renesas.com> usb: renesas_usbhs: Fix power-off ordering on unbind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform: Provide a remove callback that returns no value Uwe Kleine-König <uwe(a)kleine-koenig.org> driver core: platform: Emit a warning if a remove callback returned non-zero Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> driver core: platform: use bus_type functions Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> driver core: platform: change logic implementing platform_driver_probe Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> driver core: platform: reorder functions Michael Bommarito <michael.bommarito(a)gmail.com> usb: gadget: configfs: fix out-of-bounds read of qw_sign Wolfram Sang <wsa+renesas(a)sang-engineering.com> hwspinlock: propagate errno when registering single lock Cosmo Chou <chou.cosmo(a)gmail.com> leds: pca9532: Fix inverted GPIO output polarity Wei Wang <wei.w.wang(a)hotmail.com> iommu/amd: Fix false positive in SB IOAPIC IVRS validation Fu Hao <fuhao(a)open-hieco.net> iommu/amd: Add support for Hygon family 18h model 4h IOAPIC Wei Wang <wei.w.wang(a)hotmail.com> iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors Vladimir Zapolskiy <vz(a)kernel.org> iommu/msm: Return -ENOMEM on memory allocation failure in probe Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Aleksandr Nogikh <nogikh(a)google.com> udf: Mark LVID buffer as uptodate before marking it dirty Hongyan Xu <getshell(a)seu.edu.cn> usb: gadget: r8a66597: avoid double free of ep0_req in probe error path Herman van Hazendonk <github.com(a)herrie.org> clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> clk: qcom: gdsc: Release pm subdomains in reverse add order Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> clk: qcom: gdsc: enable optional power domain support Herman van Hazendonk <github.com(a)herrie.org> clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains Herman van Hazendonk <github.com(a)herrie.org> clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status David Woodhouse <dwmw(a)amazon.co.uk> timekeeping: Account for monotonicity adjustment in ntp_error Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 Yuho Choi <dbgh9129(a)gmail.com> clocksource: Unregister subsystem on device registration failure Jiangshan Yi <yijiangshan(a)kylinos.cn> selftests: timers: leap-a-day: Fix -w option and update usage comment Kemeng Shi <shikemeng(a)huaweicloud.com> irqchip/gic-v3-its: Fix memleak in its_probe_one() Feng Yang <yangfeng(a)kylinos.cn> selftests/bpf: Fix memory leak in msg_alloc_iov Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/bpf: Fix memory leak in msg_alloc_iov error path Evgenii Burenchev <evg28bur(a)yandex.ru> ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() Dawei Feng <dawei.feng(a)seu.edu.cn> staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() Ayush Mukkanwar <ayushmukkanwar(a)gmail.com> staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions Yuvraj Singh Chauhan <ysinghcin(a)gmail.com> staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown Ayush Mukkanwar <ayushmukkanwar(a)gmail.com> staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown Dan Carpenter <error27(a)gmail.com> staging: fbtft: Use sysfs_emit_at() to print to sysfs file Bryam Vargas <hexlabsecurity(a)proton.me> greybus: audio: bound the topology section sizes against the fetched size Ahmet Sezgin Duran <ahmet(a)sezginduran.net> staging: sm750fb: gate dualview dataflow using g_dualview Alexander A. Klimov <grandmaster(a)al2klimov.de> staging: greybus: audio: correct sscanf() return value check Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Add cleanup.h based auto release via __free(device_node) markings Haowen Tu <tuhaowen(a)uniontech.com> PM: sleep: Fix off-by-one in wakelocks number limit check Yuho Choi <dbgh9129(a)gmail.com> bus: ti-sysc: Fix /chosen node reference leak Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet-rdma: factor out response resource cleanup Pengpeng Hou <pengpeng(a)iscas.ac.cn> crypto: sa2ul - stop probe if context pool creation fails Tang Bin <tangbin(a)cmss.chinamobile.com> crypto: sa2ul - Use the defined variable to clean code Lothar Rubusch <l.rubusch(a)gmail.com> crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - reject hardware ECDH without a public key Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - clean up and improve ECDH comments Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - replace min_t with min Lee Jones <lee.jones(a)linaro.org> crypto: atmel-ecc - Struct headers need to start with keyword 'struct' Meng Yu <yumeng18(a)huawei.com> crypto: ecdh - move curve_id of ECDH from the key to algorithm name Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix memory overread in ring handler Hisam Mehboob <hisamshar(a)gmail.com> selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check Hanlin Song <pgeorge8929(a)gmail.com> csky: Fix a4/a5 restoration in syscall trace path Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> soundwire: qcom: Fix port exhaustion check in stream_alloc_ports Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> soundwire: qcom: add static port map support Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> soundwire: qcom: update port map allocation bit mask Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> soundwire: add static port mapping support Vladimir Zapolskiy <vz(a)kernel.org> dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe Suraj Gupta <suraj.gupta2(a)amd.com> dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Vladimir Zapolskiy <vz(a)kernel.org> dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup Sean Young <sean(a)mess.org> media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define Sean Young <sean(a)mess.org> media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define Daniel McCarthy <daniel(a)dragonzap.com> pinctrl: bcm2835: Don't remove an unregistered GPIO chip Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails Henrik Grimler <henrik.grimler(a)axis.com> drm/lima: call drm_mm_init() with a valid allocation range Brian Masney <bmasney(a)redhat.com> clk: imx: scu: drop redundant init.ops variable assignment Anson Huang <Anson.Huang(a)nxp.com> clk: imx: scu: Add A72 frequency scaling support Anson Huang <Anson.Huang(a)nxp.com> clk: imx: scu: Add A53 frequency scaling support Weigang He <geoffreyhe2(a)gmail.com> ARM: imx: fix device_node refcount leak in imx_src_init() Min zhang <zhangmin2026(a)yeah.net> clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller Alexander A. Klimov <grandmaster(a)al2klimov.de> clk: moxart: remove unused variables, fix refcount leak Gui-Dong Han <hanguidong02(a)gmail.com> media: cec-pin: Fix event FIFO ordering Weigang He <geoffreyhe2(a)gmail.com> soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Michael Bommarito <michael.bommarito(a)gmail.com> HID: roccat: bound device-supplied profile index Philipp Weber <kernel(a)phwe.de> HID: core: quiesce input in hid_hw_stop() to prevent use-after-free Konstantin Andreev <andreev(a)swemel.ru> smack: restrict smackfs/{direct,mapped} values to 0-255 Konstantin Andreev <andreev(a)swemel.ru> smack: deduplicate smackfs/{direct,mapped} file_operations Dmitry Antipov <dmantipov(a)yandex.ru> smack: simplify write handlers of sysfs entries Austin Kim <austin.kim(a)lge.com> smack: mark 'smack_enabled' global variable as __initdata Konstantin Andreev <andreev(a)swemel.ru> smack: fix incorrect task context in smack_msg_queue_msgrcv Casey Schaufler <casey(a)schaufler-ca.com> Smack: fix W=1 build warnings Maxime Ripard <mripard(a)kernel.org> drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure Daniel Borkmann <daniel(a)iogearbox.net> bpf: Enforce expected_attach_type for tailcall compatibility Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: align gxbb_32k_clk_sel number of parents with actual count Mahesh Rao <mahesh.rao(a)altera.com> firmware: stratix10-svc: Add mutex in stratix10 memory management Arnaldo Carvalho de Melo <acme(a)redhat.com> perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: avoid CRC corruption due to parallel claim add Jian Shen <shenjian15(a)huawei.com> net: hns3: don't auto enable misc vector Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: aiptek - validate raw macro indices before updating state Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Xiang Mei <xmei5(a)asu.edu> bridge: mrp: reject zero test interval to avoid OOM panic Wang Liang <wangliang74(a)huawei.com> net: fix NULL pointer dereference in l3mdev_l3_rcv Andrei Matei <andreimatei1(a)gmail.com> bpf: Guard stack limits against 32bit overflow Sechang Lim <rhkrqnwk98(a)gmail.com> tcp: clear sock_ops cb flags before force-closing a child socket Arthur Gautier <baloo(a)superbaloo.net> xhci: fix lost bounce buffers on TDs spanning several ring segments Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Fix list of formats on the primary plane Wentao Liang <vulab(a)iscas.ac.cn> drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Danilo Krummrich <dakr(a)kernel.org> drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold <johan(a)kernel.org> drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: fix i_size when pinned fallocate partially fails Hao-Qun Huang <alvinhuang0603(a)gmail.com> f2fs: reject overlapping move range after len expansion Wenjie Qi <qwjhust(a)gmail.com> f2fs: return symlink writeback errors Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Arash Golgol <arash.golgol(a)gmail.com> media: vimc: fix pixel format lookup in enum_framesizes Uday Khare <udaykhare77(a)gmail.com> media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya <birenpandya(a)gmail.com> media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ilya Krutskih <devsec(a)tpz.ru> media: tda18250: fix possible integer overflow Lei Huang <huanglei(a)kylinos.cn> media: s2255: check firmware size before reading trailing marker HyeongJun An <sammiee5311(a)gmail.com> media: s2255: bound JPEG frame size before copying into the buffer Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Christian Hewitt <christianshewitt(a)gmail.com> media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov7740: fix use-after-destroy in remove Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han <jiangong.han(a)windriver.com> media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> media: em28xx: defer audio-only extension registration Fan Wu <fanwu01(a)zju.edu.cn> media: cx23885: cancel NetUP CI work before teardown Bryam Vargas <hexlabsecurity(a)proton.me> media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang <ruoyuw560(a)gmail.com> media: cobalt: Avoid freeing ALSA private data twice Dawei Feng <dawei.feng(a)seu.edu.cn> media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang <ruoyuw560(a)gmail.com> media: cec: Serialize exclusive follower delivery Yi Ding <yi.s.ding(a)gmail.com> media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Valery Borovsky <vebohr(a)gmail.com> media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Restore sigset on error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory leak in guest debug handling Carlos López <clopez(a)suse.de> KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen <congnt264(a)gmail.com> iio: srf04: fix pm_runtime handling on probe error path Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze <giorgi(a)tchankvetadze.com> iio: light: cm32181: return zero after writing calibscale Cong Nguyen <congnt264(a)gmail.com> iio: gyro: mpu3050: fix sign of raw angular velocity readings Erick Henrique <erick.henrique.rodrigues(a)usp.br> iio: dac: m62332: Fix regulator reference count imbalance Linmao Li <lilinmao(a)kylinos.cn> iio: chemical: sgp30: Handle IAQ thread creation failure WenTao Liang <vulab(a)iscas.ac.cn> ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Haoxiang Li <haoxiang_li2024(a)163.com> AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l33: drain threaded IRQ before runtime suspend Linkai Gong <gonglinkai(a)kylinos.cn> i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: avoid unaligned fault in IP extraction Zhiling Zou <zhilinz(a)nebusec.ai> batman-adv: fix stale receive device on merged fragments Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: rawnand: validate ONFI extended parameter page sections Xu Rao <raoxu(a)uniontech.com> mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: afs: validate v2 image info bounds Helge Deller <deller(a)gmx.de> parisc: Fix alignment of asm statements in head.S Pei Xiao <xiaopei01(a)kylinos.cn> parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas <hexlabsecurity(a)proton.me> nvdimm/btt: reject an arena whose nfree is below the lane count caina <caina(a)uniontech.com> Revert "irqchip/mbigen: Fix mbigen node address layout" Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: check the data direction of a C2HData PDU Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix race between non-atomic ops and trigger-start Ahmad Byagowi <ahmadexp(a)gmail.com> i2c: mux: Fix channel node leak on adapter add failure Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Fix kernel address leakages in LBR stack Hajo Noerenberg <hajo-linux-ide(a)noerenberg.de> ata: ahci: work around lost interrupts on Marvell 88SE61xx Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Complete descriptors before pausing Mikulas Patocka <mpatocka(a)redhat.com> dm: fix resume-vs-remove race Ibrahim Hashimov <security(a)auditcode.ai> HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie(a)gmail.com> HID: rmi: fix OOB access with undersized RMI reports Runyu Xiao <runyu.xiao(a)seu.edu.cn> scsi: pm8001: Use rollback index when freeing MSI-X vectors Sujal Tuladhar <sujaltuladhar1231(a)gmail.com> scsi: target: iscsi: Reserve a terminator byte for the login payload Can Peng <pengcan(a)kylinos.cn> thermal/drivers/qoriq: Disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> thermal/drivers/imx: Disable clock on runtime resume failure Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki <lovekeshsolanki00(a)gmail.com> USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jameson Thies <jthies(a)google.com> usb: typec: ucsi: displayport: Fix OOB altmode array index Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Liu Qi <liuqi(a)longcheer.com> usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: usbtv: keep device alive while ALSA card exists HyeongJun An <sammiee5311(a)gmail.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: image: mdc800: change kmalloc() to kzalloc() Sabrina Dubroca <sd(a)queasysnail.net> espintcp: remove encap socket caching to avoid reference leak Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Steven Rostedt <rostedt(a)goodmis.org> tracing/mmiotrace: Remove reference to unused per CPU data pointer D. Wythe <alibuda(a)linux.alibaba.com> net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid implicit conversions in services code Eric Dumazet <edumazet(a)google.com> tcp: fix potential race in tcp_v6_syn_recv_sock() Youngjae Kwon <yjkwon0026(a)snu.ac.kr> fsnotify: Fix stale object mask after concurrent mark updates Jinjie Ruan <ruanjinjie(a)huawei.com> entry: Fix seccomp bypass after ptrace with TSYNC Tristan Madani <tristmd(a)gmail.com> RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Use the correct size of wqe when processing SRQ Dan Carpenter <dan.carpenter(a)oracle.com> RDMA/rxe: Missing unlock on error in get_srq_wqe() Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Fix over copying in get_srq_wqe Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Yuqi Xu <xuyuqiabc(a)gmail.com> openvswitch: Fix CT limit teardown use-after-free Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix kernel-doc warnings in internal headers Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Chuck Lever <cel(a)kernel.org> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <cel(a)kernel.org> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <cel(a)kernel.org> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Fix racy access at PCM trigger Fedor Pchelkin <pchelkin(a)ispras.ru> Revert "USB: serial: keyspan_pda: fix information leak" ------------- Diffstat: .../ABI/testing/configfs-usb-gadget-uac1_legacy | 3 - Documentation/usb/gadget-testing.rst | 3 - Makefile | 4 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/arm/boot/dts/armada-388-helios4.dts | 13 + arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- arch/arm/mach-imx/src.c | 1 + arch/arm/mach-lpc32xx/common.c | 5 +- arch/arm/mach-lpc32xx/common.h | 2 + arch/arm/mach-lpc32xx/phy3250.c | 2 + arch/arm/mach-lpc32xx/pm.c | 5 +- arch/arm/mm/fault.c | 16 +- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 4 +- .../boot/dts/marvell/armada-3720-turris-mox.dts | 3 +- arch/arm64/boot/dts/rockchip/Makefile | 1 + .../boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 6 +- .../boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts | 41 ++ arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + arch/arm64/kernel/hibernate.c | 16 +- arch/csky/kernel/entry.S | 6 +- arch/m68k/kernel/traps.c | 4 +- arch/mips/kernel/ptrace.c | 6 +- arch/openrisc/kernel/entry.S | 43 ++- arch/parisc/kernel/head.S | 1 + arch/powerpc/configs/85xx-hw.config | 1 + arch/powerpc/kernel/smp.c | 3 + arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/s390/kvm/guestdbg.c | 7 +- arch/s390/kvm/interrupt.c | 2 +- arch/s390/kvm/kvm-s390.c | 7 +- arch/x86/events/intel/lbr.c | 12 +- arch/x86/events/intel/uncore.c | 2 - arch/x86/include/asm/insn-eval.h | 36 ++ arch/x86/include/asm/pkeys.h | 3 + arch/x86/kvm/emulate.c | 26 +- arch/x86/kvm/hyperv.c | 25 +- block/blk-iocost.c | 2 +- block/blk-stat.c | 2 +- block/kyber-iosched.c | 2 +- crypto/ecdh.c | 74 ++-- crypto/ecdh_helper.c | 4 +- crypto/testmgr.c | 13 +- crypto/testmgr.h | 42 +- drivers/accessibility/speakup/keyhelp.c | 17 +- drivers/accessibility/speakup/kobjects.c | 6 +- drivers/acpi/bus.c | 4 +- drivers/acpi/pci_root.c | 3 +- drivers/acpi/processor_core.c | 31 +- drivers/acpi/processor_idle.c | 34 +- drivers/acpi/utils.c | 50 ++- drivers/ata/ahci.c | 49 +++ drivers/ata/libata-scsi.c | 28 +- drivers/base/firmware_loader/fallback.c | 38 +- drivers/base/firmware_loader/firmware.h | 10 + drivers/base/platform.c | 424 +++++++++++---------- drivers/base/soc.c | 19 +- drivers/base/swnode.c | 2 +- drivers/bluetooth/btmtksdio.c | 13 +- drivers/bluetooth/btusb.c | 15 +- drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/bus/ti-sysc.c | 12 +- drivers/char/hw_random/ks-sa-rng.c | 22 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/ppdev.c | 10 +- drivers/char/tpm/st33zp24/st33zp24.c | 8 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 +- drivers/clk/clk-moxart.c | 14 - drivers/clk/clk-palmas.c | 14 +- drivers/clk/hisilicon/reset.c | 2 +- drivers/clk/imx/clk-scu.c | 7 +- drivers/clk/meson/gxbb.c | 2 +- drivers/clk/qcom/common.c | 4 +- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/qcom/gdsc.c | 108 +++++- drivers/clk/qcom/gdsc.h | 2 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + drivers/clk/x86/clk-pmc-atom.c | 3 + drivers/clocksource/clps711x-timer.c | 2 +- drivers/clocksource/timer-armada-370-xp.c | 18 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 6 +- drivers/cpufreq/intel_pstate.c | 9 +- drivers/cpufreq/spear-cpufreq.c | 4 +- drivers/crypto/atmel-ecc.c | 73 ++-- drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/sa2ul.c | 19 +- drivers/dma/dw-edma/dw-edma-core.c | 34 +- drivers/dma/hisi_dma.c | 2 +- drivers/dma/mediatek/mtk-uart-apdma.c | 2 +- drivers/dma/qcom/bam_dma.c | 1 + drivers/dma/xilinx/xilinx_dma.c | 12 +- drivers/firmware/google/coreboot_table.c | 35 +- drivers/firmware/google/coreboot_table.h | 1 + drivers/firmware/stratix10-svc.c | 21 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 74 ++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 6 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 24 ++ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 35 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 6 +- drivers/gpu/drm/lima/lima_device.c | 12 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 - drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sun4i/sun4i_crtc.c | 2 +- drivers/gpu/drm/sun4i/sun4i_tcon.c | 20 +- drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 2 + drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 2 +- drivers/gpu/drm/sun4i/sun8i_vi_scaler.c | 18 +- drivers/gpu/drm/tve200/tve200_drv.c | 1 + drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/host1x/debug.c | 4 +- drivers/gpu/host1x/hw/channel_hw.c | 5 +- drivers/hid/hid-core.c | 127 +++--- drivers/hid/hid-lg4ff.c | 8 + drivers/hid/hid-mcp2221.c | 7 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-rmi.c | 46 ++- drivers/hid/hid-roccat-kone.c | 8 +- drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++- drivers/hid/i2c-hid/i2c-hid-core.c | 16 +- drivers/hid/wacom_wac.c | 13 + drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/emc1403.c | 6 +- drivers/hwmon/max6621.c | 8 +- drivers/hwspinlock/hwspinlock_core.c | 2 +- drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/i3c/master.c | 11 +- drivers/i3c/master/dw-i3c-master.c | 10 +- drivers/iio/accel/dmard09.c | 7 + drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 24 +- drivers/iio/light/isl29028.c | 2 +- drivers/iio/light/tsl2583.c | 2 +- drivers/iio/light/tsl2772.c | 2 +- drivers/iio/orientation/hid-sensor-rotation.c | 20 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/infiniband/core/cma.c | 6 +- drivers/infiniband/core/device.c | 25 +- drivers/infiniband/core/restrack.c | 4 +- drivers/infiniband/core/ucma.c | 7 +- drivers/infiniband/hw/cxgb4/device.c | 8 +- drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/efa/efa_verbs.c | 15 +- drivers/infiniband/hw/hfi1/chip.c | 4 +- drivers/infiniband/hw/hfi1/hfi.h | 2 - drivers/infiniband/hw/hfi1/init.c | 43 +-- drivers/infiniband/hw/hfi1/user_sdma.c | 13 +- drivers/infiniband/hw/mlx5/cong.c | 8 +- drivers/infiniband/hw/mlx5/qp.c | 25 +- drivers/infiniband/sw/rxe/rxe_resp.c | 13 +- drivers/infiniband/sw/siw/siw_cm.c | 32 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + drivers/infiniband/ulp/isert/ib_isert.c | 85 ++++- drivers/infiniband/ulp/isert/ib_isert.h | 1 + drivers/infiniband/ulp/srp/ib_srp.c | 45 ++- drivers/infiniband/ulp/srpt/ib_srpt.c | 20 +- drivers/input/tablet/aiptek.c | 13 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 42 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 14 +- drivers/iommu/dma-iommu.c | 13 +- drivers/iommu/intel/iommu.c | 16 +- drivers/iommu/msm_iommu.c | 2 +- drivers/irqchip/irq-gic-v3-its.c | 15 +- drivers/irqchip/irq-mbigen.c | 20 +- drivers/leds/leds-pca9532.c | 18 +- drivers/mailbox/rockchip-mailbox.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm.c | 2 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 16 + drivers/md/raid5-ppl.c | 4 +- drivers/media/cec/core/cec-adap.c | 8 +- drivers/media/cec/core/cec-pin.c | 8 +- drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 + drivers/media/usb/usbtv/usbtv-audio.c | 11 + drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/mfd/iqs62x.c | 2 +- drivers/mfd/rave-sp.c | 64 +++- drivers/misc/ad525x_dpot-i2c.c | 4 +- drivers/misc/ad525x_dpot-spi.c | 4 +- drivers/misc/ad525x_dpot.c | 181 +++++---- drivers/misc/ad525x_dpot.h | 5 +- drivers/misc/cardreader/rtsx_pcr.c | 2 + drivers/misc/cardreader/rtsx_usb.c | 23 +- drivers/misc/vmw_vmci/vmci_event.c | 4 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/mtdpart.c | 3 +- drivers/mtd/mtdswap.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 +- drivers/mtd/parsers/afs.c | 7 + drivers/mtd/ubi/attach.c | 4 +- drivers/mtd/ubi/build.c | 63 ++- drivers/mtd/ubi/cdev.c | 5 +- drivers/mtd/ubi/eba.c | 5 +- drivers/mtd/ubi/fastmap-wl.c | 53 ++- drivers/mtd/ubi/fastmap.c | 76 +--- drivers/mtd/ubi/io.c | 13 +- drivers/mtd/ubi/ubi.h | 19 +- drivers/mtd/ubi/wl.c | 38 +- drivers/mtd/ubi/wl.h | 6 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/freescale/fec_main.c | 6 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 12 +- drivers/net/ethernet/nvidia/forcedeth.c | 6 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 + drivers/net/ethernet/realtek/8139cp.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 35 +- drivers/net/gtp.c | 2 + drivers/net/ipvlan/ipvlan_l3s.c | 1 - drivers/net/ntb_netdev.c | 38 +- drivers/net/ppp/pppox.c | 17 + drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt.c | 6 +- drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath10k/snoc.c | 9 +- drivers/net/wireless/ath/ath11k/debug.c | 12 +- drivers/net/wireless/ath/ath11k/debug.h | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 32 +- drivers/net/wireless/ath/ath11k/trace.c | 1 + drivers/net/wireless/ath/ath11k/trace.h | 172 +++++++++ drivers/net/wireless/ath/ath11k/wmi.c | 15 +- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + drivers/net/wireless/ath/ath6kl/wmi.c | 17 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 8 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 6 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 6 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 8 + drivers/nfc/pn533/pn533.c | 21 +- drivers/ntb/ntb_transport.c | 38 +- drivers/nvdimm/btt.c | 8 + drivers/nvdimm/label.c | 17 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/host/tcp.c | 11 +- drivers/nvme/target/rdma.c | 13 +- drivers/nvme/target/tcp.c | 10 + drivers/of/base.c | 2 +- drivers/of/property.c | 10 +- drivers/parisc/eisa.c | 5 + drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/pci-sysfs.c | 45 ++- drivers/pci/proc.c | 8 +- drivers/pci/quirks.c | 2 +- drivers/perf/arm_spe_pmu.c | 2 +- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 1 - drivers/pinctrl/pinctrl-rockchip.c | 10 + drivers/platform/chrome/cros_ec_sensorhub_ring.c | 28 +- drivers/power/supply/bd99954-charger.h | 23 +- drivers/power/supply/bq27xxx_battery.c | 6 +- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/isp1704_charger.c | 1 + drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/max17040_battery.c | 2 +- drivers/power/supply/sbs-battery.c | 160 +++++--- drivers/power/supply/sc2731_charger.c | 8 +- drivers/pps/pps.c | 10 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/rapidio/rio-scan.c | 1 + drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/core.c | 6 +- drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-rpmh-regulator.c | 6 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/remoteproc/qcom_common.c | 4 +- drivers/remoteproc/remoteproc_core.c | 357 +++++++++++++---- drivers/remoteproc/remoteproc_elf_loader.c | 12 +- drivers/remoteproc/remoteproc_sysfs.c | 35 +- drivers/remoteproc/remoteproc_virtio.c | 6 +- drivers/rpmsg/qcom_glink_native.c | 36 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/rtc/rtc-pcf8563.c | 4 +- drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/mpt3sas/mpt3sas_base.c | 2 + drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_bsg.c | 39 +- drivers/scsi/qla2xxx/qla_def.h | 2 + drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 47 ++- drivers/scsi/qla2xxx/qla_inline.h | 13 + drivers/scsi/qla2xxx/qla_isr.c | 20 +- drivers/scsi/qla2xxx/qla_mbx.c | 26 +- drivers/scsi/qla2xxx/qla_nx2.c | 2 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/qla2xxx/qla_target.c | 24 +- drivers/scsi/qla2xxx/qla_target.h | 1 + drivers/scsi/qla2xxx/tcm_qla2xxx.c | 61 +-- drivers/scsi/scsi_lib.c | 2 + drivers/soc/bcm/bcm2835-power.c | 7 +- drivers/soc/samsung/exynos-pmu.c | 4 +- drivers/soc/ti/knav_qmss.h | 1 + drivers/soc/ti/knav_qmss_queue.c | 14 +- drivers/soundwire/qcom.c | 31 +- drivers/spi/spi-img-spfi.c | 5 +- drivers/spi/spi-sprd-adi.c | 6 + drivers/staging/fbtft/fbtft-sysfs.c | 2 +- drivers/staging/greybus/audio_gb.c | 13 + drivers/staging/greybus/audio_manager_sysfs.c | 2 +- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/octeon/ethernet-mem.c | 31 +- drivers/staging/octeon/ethernet-mem.h | 5 +- drivers/staging/octeon/ethernet-rx.c | 2 +- drivers/staging/octeon/ethernet-tx.c | 2 + drivers/staging/octeon/ethernet.c | 6 +- drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 4 +- drivers/staging/sm750fb/sm750.c | 4 +- drivers/target/iscsi/iscsi_target.c | 16 +- drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/target/target_core_transport.c | 345 +++++++++-------- drivers/target/target_core_xcopy.c | 8 +- drivers/thermal/imx_thermal.c | 9 +- .../intel/int340x_thermal/int3400_thermal.c | 9 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/tty/hvc/Kconfig | 2 +- drivers/tty/serial/amba-pl011.c | 10 + drivers/tty/tty_io.c | 4 +- drivers/uio/uio.c | 5 + drivers/usb/atm/usbatm.c | 4 +- drivers/usb/gadget/configfs.c | 4 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_mass_storage.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 43 ++- drivers/usb/gadget/function/f_uac1_legacy.c | 56 --- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/u_uac1_legacy.h | 3 - drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/gadget/udc/r8a66597-udc.c | 1 - drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/host/xhci-ring.c | 32 +- drivers/usb/image/mdc800.c | 4 +- drivers/usb/phy/phy-fsl-usb.c | 52 +-- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/renesas_usbhs/common.c | 6 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 2 +- drivers/vfio/pci/vfio_pci_config.c | 1 + drivers/video/fbdev/kyro/fbdev.c | 24 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/uvesafb.c | 2 + drivers/virtio/virtio_balloon.c | 6 + drivers/w1/masters/ds2482.c | 4 + drivers/w1/slaves/w1_ds28e17.c | 8 + drivers/xen/xenbus/xenbus_xs.c | 16 +- fs/ceph/caps.c | 11 +- fs/ceph/xattr.c | 1 + fs/cifs/cifs_debug.c | 2 +- fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/ext4/file.c | 7 + fs/ext4/inode.c | 10 + fs/f2fs/file.c | 9 +- fs/f2fs/namei.c | 11 +- fs/fat/misc.c | 4 + fs/fat/nfs.c | 4 +- fs/hfsplus/catalog.c | 25 +- fs/hfsplus/hfsplus_fs.h | 6 + fs/hugetlbfs/inode.c | 3 +- fs/isofs/compress.c | 1 + fs/lockd/svcsubs.c | 53 +-- fs/nfs/client.c | 21 +- fs/nfs/file.c | 2 + fs/nfs/filelayout/filelayoutdev.c | 3 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 3 +- fs/nfs/inode.c | 111 +++--- fs/nfs/internal.h | 1 + fs/nfs/netns.h | 6 +- fs/nfs/nfs4client.c | 1 + fs/nfs/nfs4proc.c | 6 +- fs/nfs/pnfs.c | 61 ++- fs/nfs/pnfs.h | 3 +- fs/nfs/pnfs_nfs.c | 39 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 31 +- fs/nfsd/nfs4proc.c | 39 +- fs/nfsd/nfs4state.c | 206 +++++++--- fs/nfsd/nfs4xdr.c | 17 + fs/nfsd/nfscache.c | 2 +- fs/nfsd/nfsfh.c | 4 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 +- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +- fs/nilfs2/direct.c | 4 +- fs/nilfs2/segment.c | 4 + fs/nilfs2/the_nilfs.c | 6 + fs/notify/fanotify/fanotify_user.c | 17 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ocfs2/acl.c | 141 ++++--- fs/ocfs2/acl.h | 19 +- fs/ocfs2/cluster/heartbeat.c | 201 +++++++--- fs/ocfs2/cluster/heartbeat.h | 7 +- fs/ocfs2/cluster/netdebug.c | 2 +- fs/ocfs2/cluster/nodemanager.c | 10 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/cluster/tcp.c | 89 ++++- fs/ocfs2/cluster/tcp.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmdomain.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/namei.c | 17 +- fs/ocfs2/refcounttree.c | 47 ++- fs/ocfs2/stack_o2cb.c | 6 +- fs/ocfs2/xattr.c | 91 +++-- fs/ocfs2/xattr.h | 9 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/squashfs/cache.c | 2 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- fs/udf/super.c | 23 +- fs/udf/symlink.c | 2 + include/acpi/acpi_bus.h | 21 + include/crypto/ecdh.h | 2 - include/linux/bitfield.h | 95 ++++- include/linux/bpf.h | 1 + include/linux/hid.h | 1 + include/linux/highmem.h | 89 ++++- include/linux/irqdomain.h | 23 ++ include/linux/list.h | 15 +- include/linux/nfs_fs.h | 1 + include/linux/nfs_xdr.h | 3 +- include/linux/of.h | 2 + include/linux/of_graph.h | 4 +- include/linux/platform_device.h | 11 + include/linux/remoteproc.h | 297 ++------------- include/linux/rsc_table.h | 364 ++++++++++++++++++ include/linux/rtsx_usb.h | 3 + include/linux/seq_buf.h | 25 ++ include/linux/soundwire/sdw.h | 2 + include/linux/trace_events.h | 3 + include/media/rc-map.h | 2 - include/net/bluetooth/l2cap.h | 11 +- include/net/inet_connection_sock.h | 11 +- include/net/ip_tunnels.h | 11 +- include/net/mac80211.h | 18 + include/net/netfilter/nf_queue.h | 1 + include/net/netfilter/nf_tables.h | 4 +- include/net/pkt_sched.h | 1 + include/net/sch_generic.h | 1 + include/net/sctp/structs.h | 2 +- include/net/tcp.h | 13 +- include/net/xfrm.h | 1 - include/target/target_core_base.h | 1 - include/target/target_core_fabric.h | 10 +- include/uapi/linux/time_types.h | 2 +- include/uapi/mtd/ubi-user.h | 8 +- kernel/auditfilter.c | 6 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/core.c | 4 + kernel/bpf/net_namespace.c | 17 +- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/verifier.c | 26 +- kernel/entry/common.c | 3 + kernel/irq/irqdomain.c | 41 +- kernel/locking/lockdep.c | 2 + kernel/power/wakelock.c | 2 +- kernel/sched/cpufreq_schedutil.c | 59 +-- kernel/sched/fair.c | 53 +-- kernel/signal.c | 4 + kernel/sys.c | 2 +- kernel/time/clocksource.c | 8 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 6 + kernel/time/timer.c | 1 + kernel/trace/trace.c | 228 +++++++++++ kernel/trace/trace.h | 3 + kernel/trace/trace_dynevent.h | 4 +- kernel/trace/trace_events.c | 32 ++ kernel/trace/trace_events_synth.c | 2 +- kernel/trace/trace_kprobe.c | 4 +- kernel/trace/trace_mmiotrace.c | 24 +- kernel/trace/trace_output.c | 2 +- kernel/trace/trace_printk.c | 11 + kernel/trace/trace_uprobe.c | 4 +- lib/iov_iter.c | 8 +- lib/string.c | 3 +- lib/test_hmm.c | 2 +- lib/ucs2_string.c | 2 +- mm/Kconfig | 3 + mm/highmem.c | 151 +++++++- mm/memcontrol.c | 6 + mm/vmscan.c | 2 +- net/batman-adv/bridge_loop_avoidance.c | 80 ++-- net/batman-adv/distributed-arp-table.c | 8 +- net/batman-adv/main.c | 4 + net/bluetooth/6lowpan.c | 25 +- net/bluetooth/ecdh_helper.c | 2 - net/bluetooth/hci_event.c | 7 +- net/bluetooth/l2cap_core.c | 58 ++- net/bluetooth/l2cap_sock.c | 114 +++++- net/bluetooth/msft.c | 5 + net/bluetooth/rfcomm/core.c | 12 +- net/bluetooth/selftest.c | 2 +- net/bluetooth/smp.c | 6 +- net/bridge/br_mrp_netlink.c | 4 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_vlan.c | 4 +- net/ceph/osdmap.c | 2 + net/core/filter.c | 6 +- net/core/lwt_bpf.c | 15 +- net/core/skbuff.c | 11 +- net/core/xdp.c | 4 +- net/dccp/dccp.h | 4 +- net/dccp/ipv4.c | 4 +- net/dccp/ipv6.c | 7 +- net/dccp/minisocks.c | 2 +- net/hsr/hsr_device.c | 14 +- net/hsr/hsr_framereg.c | 63 ++- net/hsr/hsr_main.h | 8 +- net/ipv4/esp4.c | 49 +-- net/ipv4/inet_connection_sock.c | 9 + net/ipv4/ip_tunnel.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_fastopen.c | 2 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/ipv6/esp6.c | 49 +-- net/ipv6/ip6_gre.c | 34 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/ipv6/tcp_ipv6.c | 98 ++--- net/ipv6/xfrm6_input.c | 2 +- net/iucv/af_iucv.c | 2 + net/kcm/kcmsock.c | 3 + net/key/af_key.c | 52 ++- net/mpls/af_mpls.c | 2 + net/mptcp/pm_netlink.c | 30 +- net/mptcp/subflow.c | 6 +- net/mptcp/syncookies.c | 1 + net/netfilter/Kconfig | 2 +- net/netfilter/ipvs/ip_vs_ftp.c | 10 +- net/netfilter/nf_nat_sip.c | 5 + net/netfilter/nf_queue.c | 16 + net/netfilter/nf_tables_api.c | 48 +-- net/netfilter/nfnetlink_queue.c | 3 + net/netfilter/xt_cgroup.c | 21 +- net/netfilter/xt_hl.c | 27 ++ net/nfc/digital_core.c | 2 +- net/nfc/llcp_core.c | 29 +- net/nfc/llcp_sock.c | 14 +- net/nfc/nci/data.c | 10 +- net/openvswitch/conntrack.c | 130 ++++--- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 60 +-- net/openvswitch/datapath.h | 26 +- net/openvswitch/vport.h | 8 + net/phonet/pep.c | 2 +- net/rds/cong.c | 4 +- net/sched/sch_api.c | 7 +- net/sched/sch_codel.c | 2 +- net/sched/sch_fq.c | 30 +- net/sched/sch_fq_codel.c | 6 +- net/sched/sch_fq_pie.c | 3 +- net/sched/sch_generic.c | 9 +- net/sched/sch_hhf.c | 4 + net/sched/sch_sfq.c | 3 +- net/sched/sch_teql.c | 1 + net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++- net/smc/af_smc.c | 2 + net/smc/smc_llc.c | 1 + net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/sunrpc/cache.c | 7 +- net/sunrpc/rpcb_clnt.c | 4 + net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 29 +- net/sunrpc/xdr.c | 2 +- net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport.c | 2 +- net/xfrm/xfrm_state.c | 3 - scripts/tags.sh | 2 +- security/apparmor/lib.c | 20 +- security/selinux/include/security.h | 4 +- security/selinux/selinuxfs.c | 7 +- security/selinux/ss/services.c | 45 ++- security/smack/smack.h | 7 +- security/smack/smack_lsm.c | 95 +++-- security/smack/smackfs.c | 222 ++++------- sound/core/pcm_native.c | 2 + sound/drivers/aloop.c | 101 +++-- sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/pci/asihpi/hpi6000.c | 5 + sound/pci/hda/hda_proc.c | 2 +- sound/pci/via82xx_modem.c | 26 +- sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/fsl/fsl-asoc-card.c | 4 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/meson/meson-card-utils.c | 17 +- sound/soc/pxa/pxa-ssp.c | 7 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/soc/soc-dapm.c | 2 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 14 +- sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- sound/usb/midi.c | 2 + tools/bpf/bpftool/map.c | 4 +- tools/include/linux/compiler.h | 2 +- tools/perf/builtin-sched.c | 40 +- tools/perf/builtin-stat.c | 15 +- tools/perf/ui/browsers/hists.c | 6 +- tools/perf/util/auxtrace.c | 15 +- tools/perf/util/cs-etm.c | 81 +++- tools/perf/util/dso.c | 19 +- tools/perf/util/intel-bts.c | 2 +- tools/perf/util/intel-pt.c | 2 +- tools/perf/util/machine.c | 34 +- tools/perf/util/synthetic-events.c | 6 +- tools/perf/util/thread-stack.c | 2 +- tools/perf/util/trace-event-read.c | 33 +- .../selftests/arm64/mte/check_ksm_options.c | 29 +- tools/testing/selftests/bpf/test_sockmap.c | 3 +- .../selftests/rseq/rseq-x86-thread-pointer.h | 4 +- tools/testing/selftests/timers/leap-a-day.c | 19 +- tools/testing/selftests/zram/zram_lib.sh | 2 +- 708 files changed, 8383 insertions(+), 4068 deletions(-)

6 days, 18 hours

[PATCH 6.18 000/583] 6.18.51-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.51 release. There are 583 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Sep 2026 13:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.51-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.51-rc1 Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback Christian Brauner <brauner(a)kernel.org> pidfs: protect PIDFD_GET_* ioctls() via ifdef Zi Yan <ziy(a)nvidia.com> mm/huge_memory: use folio's memcg inside __folio_split() Matthew Wilcox (Oracle) <willy(a)infradead.org> migrate: replace RMP_ flags with TTU_ flags Zi Yan <ziy(a)nvidia.com> mm/huge_memory: replace can_split_folio() with direct refcount calculation Zi Yan <ziy(a)nvidia.com> mm/huge_memory: change folio_split_supported() to folio_check_splittable() Muchun Song <muchun.song(a)linux.dev> mm: thp: use folio_batch to handle THP splitting in deferred_split_scan() Muchun Song <muchun.song(a)linux.dev> mm: thp: introduce folio_split_queue_lock and its variants SJ Park <sj(a)kernel.org> mm/damon/core: initialize damos->last_applied SJ Park <sj(a)kernel.org> mm/damon/core-kunit: handle region split failure in filter_out() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() SJ Park <sj(a)kernel.org> mm/damon/core: skip aging from repeated aggressive merging SJ Park <sj(a)kernel.org> mm/damon/ops-common: use nr_accesses moving sum for quota score SJ Park <sj(a)kernel.org> mm/damon/paddr: drop last same folio access check reuse optimization SJ Park <sj(a)kernel.org> mm/damon/vaddr: drop last same folio access check optimization SJ Park <sj(a)kernel.org> mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() Robin Murphy <robin.murphy(a)arm.com> iommu/arm-smmu-v3: Add HAFT support for SVA Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ab8500_fg: fix use-after-free on remove Pan Chuang <panchuang(a)vivo.com> power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() Song Hu <husong(a)kylinos.cn> Docs/ABI/damon: fix typo in intervals_goal sysfs path Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Kiryl Shutsemau <kas(a)kernel.org> hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU Kiryl Shutsemau <kas(a)kernel.org> mm: rework compound_head() for power-of-2 sizeof(struct page) Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: set default primary compressor in zram_destroy_comps() Yuwen Chen <ywen.chen(a)foxmail.com> zram: fix the issue that the write - back limits might overflow Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: read slot block idx under slot lock Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: drop wb_limit_lock Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: take write lock in wb limit store handlers Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in read_block_state() Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: fixup read_block_state() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during close_lru reaping Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during blocked-lock reaping Chuck Lever <chuck.lever(a)oracle.com> NFSD: Consolidate the revocation-path client unpin Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: reject a tree connect response whose byte count is too small David Howells <dhowells(a)redhat.com> cifs: Do some preparation prior to organising the function declarations Frank Sorenson <sorenson(a)redhat.com> smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 David Howells <dhowells(a)redhat.com> cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h David Howells <dhowells(a)redhat.com> cifs: SMB1 split: Create smb1proto.h for SMB1 declarations David Howells <dhowells(a)redhat.com> cifs: Remove dead function prototypes Jiangshan Yi <yijiangshan(a)kylinos.cn> smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/smb2proto.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/fs_context.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/fscache.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/cifs_unicode.h Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during admin state revocation Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: convert global state_lock to per-net deleg_lock Jeff Layton <jlayton(a)kernel.org> nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Jeff Layton <jlayton(a)kernel.org> nfsd: fix UAF in async copy cancel and shutdown Jeff Layton <jlayton(a)kernel.org> nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Jeff Layton <jlayton(a)kernel.org> nfsd: fix clock domain mismatch in clients_still_reclaiming() Jeff Layton <jlayton(a)kernel.org> nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Jeff Layton <jlayton(a)kernel.org> nfsd: move struct nfsd_genl_rqstp to nfsctl.c Jeff Layton <jlayton(a)kernel.org> nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Eric Dumazet <edumazet(a)google.com> ipv4: use dst4_mtu() instead of dst_mtu() Eric Dumazet <edumazet(a)google.com> ipv6: use dst6_mtu() instead of dst_mtu() Eric Dumazet <edumazet(a)google.com> inet: add dst4_mtu() and dst6_mtu() helpers Eric Dumazet <edumazet(a)google.com> ipv6: add some unlikely()/likely() clauses in ip6_output.c Eric Dumazet <edumazet(a)google.com> ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts() Xiang Mei <xmei5(a)asu.edu> fuse: copy request headers via a stack buffer for io-uring Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: use named constants for io-uring iovec indices Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor setting up copy state for payload copying Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: use enum types for header copying Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor io-uring header copying from ring Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor io-uring header copying to ring Joanne Koong <joannelkoong(a)gmail.com> fuse: fix missing barrier when checking io-uring readiness Ali Tariq <alitariq45892(a)gmail.com> PCI: starfive: Fix resource leaks on error paths in host_init() Hal Feng <hal.feng(a)starfivetech.com> PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots Oscar Ou <oscarou(a)synology.com> lockd: fix swapped arguments in nlmsvc_match_ip() Doruk Tan Ozturk <doruk(a)0sec.ai> ocfs2: validate directory-index entry counts when reading metadata Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: validate dx_root extent list fields during block read Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> ASoC: codecs: aw88261: only check PLL and clock state at power-up Val Packett <val(a)packett.cool> ASoC: codecs: aw88261: reduce log spam Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> firmware: qcom_scm: Rename peripheral as pas_id Tejun Heo <tj(a)kernel.org> sched/core: Make core-sched flips wait for in-flight selections John Stultz <jstultz(a)google.com> sched: Rework prev_balance() to avoid stale prev references John Stultz <jstultz(a)google.com> sched: Add assert_balance_callbacks_empty helper Tejun Heo <tj(a)kernel.org> sched_ext: Fix inverted ops.core_sched_before() invocation Linkai Gong <gonglinkai(a)kylinos.cn> scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Embed counter driver data in rdma_counter allocation fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix exit_task leak on fork failure during enable Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject Read lists that exceed the page budget Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject oversized Read segments at decode time Chuck Lever <chuck.lever(a)oracle.com> rpcrdma: arm rn_done before publishing the notification Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Release transport resources synchronously Chris Mason <clm(a)meta.com> SUNRPC: fix gssx_dec_option_array error path bugs Dave Jiang <dave.jiang(a)intel.com> cxl/mce: Make the MCE notifier per-region Smita Koralahalli <Smita.KoralahalliChannabasappa(a)amd.com> cxl/region: Add helper to check Soft Reserved containment by CXL regions Dan Williams <dan.j.williams(a)intel.com> dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Jiri Olsa <jolsa(a)kernel.org> bpf: Disable preemption in bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Use stack id functions instead of __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_new_bucket from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_fastpath function from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_init function from __bpf_get_stackid Haoxiang Li <haoxiang_li2024(a)163.com> cpufreq: apple-soc: Fix OPP table cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Add locking around AML evaluations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Rearrange RT data validation checking Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: x86/rtc-cmos: Use platform device for driver binding Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: x86: cmos_rtc: Create a CMOS RTC platform device Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ Nikhil Gurudasani <nikhilgurudasani314(a)gmail.com> erofs: skip sufficiently large global buffers when resizing Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Florian Pradines <florian.pradines(a)gmail.com> HID: mcp2221: fix OOB write in mcp2221_raw_event() Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: clean up device list on probe failure Rosalie Wanders <rosalie(a)mailbox.org> HID: sony: use guard() and scoped_guard() Frank Sorenson <sorenson(a)redhat.com> cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Huiwen He <hehuiwen(a)kylinos.cn> smb/client: emulate small EOF-extending mode 0 fallocate ranges Huiwen He <hehuiwen(a)kylinos.cn> smb/client: reduce fallocate zero buffer allocation ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move some definitions from common/smb2pdu.h into common/fscc.h Sam Edwards <cfsworks(a)gmail.com> ceph: properly decrypt filenames in vmalloc() buffers Chuck Lever <chuck.lever(a)oracle.com> NFSD: Guard admin state-revocation walks with NFSD_NET_UP Max Kellermann <max.kellermann(a)ionos.com> ceph: force a cap message when a deferred revoke can't be acked immediately Michael Bommarito <michael.bommarito(a)gmail.com> ceph: cap delegated inode count in ceph_parse_deleg_inos() Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Terry Bowman <terry.bowman(a)amd.com> cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Fix Use-After-Free in AIO error path Gabriel Prostitis <prostitisgabriel(a)gmail.com> USB: gadget: ffs: fix mm lifetime handling Brendan Jackman <jackmanb(a)google.com> mm/page_alloc: don't spin_trylock() in NMI on UP Roger Pau Monne <roger(a)xenproject.org> x86/xen: fix init of balloon stats again Roger Pau Monne <roger.pau(a)citrix.com> xen/balloon: improve accuracy of initial balloon target for dom0 Li Xiasong <lixiasong1(a)huawei.com> mm/slub: fix missing debugfs entries for caches created before sysfs init Vlastimil Babka <vbabka(a)suse.cz> mm/slab: move and refactor __kmem_cache_alias() Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_migrate_one() Kairui Song <kasong(a)tencent.com> mm/mglru: fix and remove redundant unevictable folio handling Kairui Song <kasong(a)tencent.com> mm/mglru: use the common routine for dirty/writeback reactivation Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Kiryl Shutsemau <kas(a)kernel.org> mm/hugetlb: refactor code around vmemmap_walk Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: defer vmemmap population for bootmem hugepages FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: prevent dead_code warning from warn_on!'s flags constant Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race between concurrent revokers Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race condition due to nesting Chen Linxuan <me(a)black-desk.cn> pidfd: hold exec_update_lock around namespace ioctl Christian Brauner <brauner(a)kernel.org> pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls Vivek Parikh <vivek.parikh(a)breachx.ai> ovl: fix double end_creating() on the casefold-mismatch path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - avoid stale fallback key after set_secret failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - clean up and improve ECDH comments Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - replace min_t with min Vinicius Costa Gomes <vinicius.gomes(a)intel.com> crypto: iaa - unmap dst before software fallback on decompress Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Eric Dumazet <edumazet(a)google.com> vlan: fix skb_under_panic and races when toggling HW VLAN offload Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix race between interrupt and resend Miklos Szeredi <mszeredi(a)redhat.com> fuse: remove fm arg of args->end callback Miklos Szeredi <mszeredi(a)redhat.com> fuse: split off fuse_args and related definitions into a separate header Joanne Koong <joannelkoong(a)gmail.com> fuse: publish io-uring queues with release semantics Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: simplify handling of Structural Parameters 1 values Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: use cached HCSPARAMS1 value Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: implement USB Port Register Set struct Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add USB Port Register Set struct Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add helper to read PORTSC register Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add tracing for PORTSC register writes David Howells <dhowells(a)redhat.com> afs: Fix leak of ungot volume Abdifatah Suruur <suruurism(a)gmail.com> ksmbd: fix use-after-free in oplock break notification Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: fix vblank interrupts on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix head state readback on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI vendor infoframes on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Faith Ekstrand <faith.ekstrand(a)collabora.com> drm/nouveau: Use write-combined maps for coherent Marek Czernohous <marek(a)czernohous.de> drm/nouveau: unsubscribe the channel-kill event before the fence context Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve stride validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve panel-size validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve framebuffer-size validation Sunday Clement <Sunday.Clement(a)amd.com> drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix error path at svm_migrate_copy_to_ram Priya Hosur <Priya.Hosur(a)amd.com> drm/amdkfd: Add TLB flush after MES queue eviction/suspension Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx12 userqueues Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx11 userqueues Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Skip accessing psp rum time db for APUs Guangshuo Li <lgs201920130244(a)gmail.com> drm/amdgpu: fix autosuspend cleanup during removal Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: Disable runtime PM for externally attached dGPUs Xiang Liu <xiang.liu(a)amd.com> drm/amdgpu: clamp the isolation index for rings outside a partition Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check thunderbolt before switcheroo registration Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Kavan Smith <kavansmith82(a)gmail.com> drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Tao Yu <tao1.yu(a)intel.com> drm/gud: validate TV mode names before creating enum property Deepanshu Kartikey <kartikey406(a)gmail.com> drm/gud: NUL-terminate TV mode names read from the device David (Ming Qiang) Wu <David.Wu3(a)amd.com> drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: validate plane degamma LUT size for private color prop Linkai Gong <gonglinkai(a)kylinos.cn> drm/amd/display: fix dc_lock leak on GPU reset error paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Use drm_atomic_helper_check_plane_state() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Fix list of formats on the primary plane Lyude Paul <lyude(a)redhat.com> drm/nouveau/disp/r535: Add scanline position support + head state support Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates in ssd133x Wentao Liang <vulab(a)iscas.ac.cn> drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates for ssd132x Deepanshu Kartikey <kartikey406(a)gmail.com> drm/i915: Guard against NULL driver_data in i915_pci_probe() Danilo Krummrich <dakr(a)kernel.org> drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold <johan(a)kernel.org> drm/panel-edp: fix i2c adapter leak on probe failure Johan Hovold <johan(a)kernel.org> drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: fix firmware control interface bounds checks Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: harden firmware build-info bounds checks Matthew Auld <matthew.auld(a)intel.com> drm/xe/vram: report FLAT_CCS base misalignment Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Chao Yu <chao(a)kernel.org> f2fs: fix to zero post-EOF data when extending file size Chao Yu <chao(a)kernel.org> f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Chen Changcheng <chenchangcheng(a)kylinos.cn> f2fs: fix valid block count leak on data block allocation failure Chao Yu <chao(a)kernel.org> f2fs: fix to clear dirty flag on folio in error path Chao Yu <chao(a)kernel.org> f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: fix i_size when pinned fallocate partially fails Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() Daeho Jeong <daehojeong(a)google.com> f2fs: fix to migrate all curseg types during free_segment_range Wenjie Qi <qwjhust(a)gmail.com> f2fs: avoid NULL checkpoint thread access in sysfs Guanghui Yang <3497809730(a)qq.com> f2fs: fix dentry folio leak in find_in_level Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential section-unaligned pinfile Wenjie Qi <qwjhust(a)gmail.com> f2fs: return writeback error from collapse range Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Joanne Chang <joannechien(a)google.com> f2fs: dirty directory inodes on mtime/ctime update Chao Yu <chao(a)kernel.org> f2fs: fix to avoid move_range and defragment on device_alias file Wenjie Qi <qwjhust(a)gmail.com> f2fs: only redirty pinned folios in redirty_blocks Hao-Qun Huang <alvinhuang0603(a)gmail.com> f2fs: reject overlapping move range after len expansion Wenjie Qi <qwjhust(a)gmail.com> f2fs: return symlink writeback errors Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Quiesce response IRQ before freeing request queue Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Initialize NVMe abort_work once at submission Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Set inst->std during default format initialization Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Guard bit depth check with initial_info_obtained Hungyu Lin <dennylin0707(a)gmail.com> media: qcom: iris: use disable_irq() during power-off Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: qcom: iris: fix state-change debug log printing stale value Ruoyu Wang <ruoyuw560(a)gmail.com> media: zoran: Avoid freeing a registered video_device twice Arash Golgol <arash.golgol(a)gmail.com> media: vimc: fix pixel format lookup in enum_framesizes Uday Khare <udaykhare77(a)gmail.com> media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya <birenpandya(a)gmail.com> media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ming Qian <ming.qian(a)oss.nxp.com> media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Xu Rao <raoxu(a)uniontech.com> media: v4l2-async: avoid deleting unlinked ASC entry on link error Ilya Krutskih <devsec(a)tpz.ru> media: tda18250: fix possible integer overflow Guangshuo Li <lgs201920130244(a)gmail.com> media: saa7164: fix cleanup on resource allocation failure Lei Huang <huanglei(a)kylinos.cn> media: s2255: check firmware size before reading trailing marker HyeongJun An <sammiee5311(a)gmail.com> media: s2255: bound JPEG frame size before copying into the buffer Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: rkvdec: Propagate platform_get_irq() errors Myeonghun Pak <mhun512(a)gmail.com> media: rc: sunxi-cir: Unregister rc device on probe failure Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Correct color map between V4L2 and ISI Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Johan Hovold <johan(a)kernel.org> media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Guangshuo Li <lgs201920130244(a)gmail.com> media: platform: mtk-mdp3: Fix SCP device refcounting Christian Hewitt <christianshewitt(a)gmail.com> media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder Cong Nguyen <congnt264(a)gmail.com> media: intel/ipu6: fix async notifier cleanup leak on parse error Dave Stevenson <dave.stevenson(a)raspberrypi.com> media: imx355: Avoid calling imx355_power_off twice in error path Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov7740: fix use-after-destroy in remove Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov02a10: fix endpoint parsing use-after-free Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Return test pattern write errors Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Release runtime PM reference on VBLANK error Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han <jiangong.han(a)windriver.com> media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> media: em28xx: defer audio-only extension registration Fan Wu <fanwu01(a)zju.edu.cn> media: cx23885: cancel NetUP CI work before teardown Bryam Vargas <hexlabsecurity(a)proton.me> media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang <ruoyuw560(a)gmail.com> media: cobalt: Avoid freeing ALSA private data twice Dawei Feng <dawei.feng(a)seu.edu.cn> media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang <ruoyuw560(a)gmail.com> media: cec: Serialize exclusive follower delivery Yi Ding <yi.s.ding(a)gmail.com> media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Hans Verkuil <hverkuil+cisco(a)kernel.org> media: cec: extron-da-hd-4k-plus: add sanity check Biren Pandya <birenpandya(a)gmail.com> media: cec: disable delayed work before freeing an interrupted transmit Jonas Karlman <jonas(a)kwiboo.se> media: cec: core: Fix kmemleak due to missed rc_free_device() call Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Remove obsolete frame_count check in venc_start_session Valery Borovsky <vebohr(a)gmail.com> media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Danilo Krummrich <dakr(a)kernel.org> rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> LoongArch: Avoid preempt count underflow without probe Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Do not save/restore percpu base register in rethook trampoline Nathan Chancellor <nathan(a)kernel.org> LoongArch: Do not select HAVE_RUST when KASAN is enabled Bibo Mao <maobibo(a)loongson.cn> LoongArch: Fix acpi_package_ids[] array overflow Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Refactor jump offset calculation in tail call Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Optimize redundant TCC loads in epilogue Han Gao <gaohan(a)iscas.ac.cn> LoongArch: Add DIRECT_MAP_PHYSMEM_END definition Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Free init resources if kvm_init() fails Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix TOCTOU race on pv_features Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly cap TLBI Range to the architural limit Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure Kajetan Puchalski <kajetan.puchalski(a)arm.com> KVM: arm64: vgic: Fix detection of MI on no pending LR Qihang <q.h.hack.winter(a)gmail.com> KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables Marc Zyngier <maz(a)kernel.org> KVM: arm64: Sign-extend VA for range-based TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly handle end of VA space TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Restore sigset on error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix length check __import_wp_info() Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Sean Christopherson <seanjc(a)google.com> KVM: x86: Serialize writes to disabled_quirks using kvm->lock Carlos López <clopez(a)suse.de> KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Yosry Ahmed <yosry(a)kernel.org> KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Always flush vpid02 on first use Amit Machhiwal <amachhiw(a)linux.ibm.com> KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Reject integration times with a non-zero seconds part Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix power down clearing bits of the wrong register Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Fix incorrect register name in threshold read error message Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Reject integration times with a non-zero seconds part Paul Geurts <paul.geurts(a)prodrive-technologies.com> iio: ti-ads7138: Disable STATS_EN bit while reading conversion results Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen <congnt264(a)gmail.com> iio: srf04: fix pm_runtime handling on probe error path Can Peng <pengcan(a)kylinos.cn> iio: pressure: mpl115: Fix runtime PM cleanup Rupesh Majhi <zoone.rupert(a)gmail.com> iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: ltrf216a: fix runtime PM reference leak in error path Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze <giorgi(a)tchankvetadze.com> iio: light: cm32181: return zero after writing calibscale Cong Nguyen <congnt264(a)gmail.com> iio: gyro: mpu3050: fix sign of raw angular velocity readings Erick Henrique <erick.henrique.rodrigues(a)usp.br> iio: dac: m62332: Fix regulator reference count imbalance Babanpreet Singh <bbnpreetsingh(a)gmail.com> iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show Linmao Li <lilinmao(a)kylinos.cn> iio: chemical: sgp30: Handle IAQ thread creation failure Fan Wu <fanwu01(a)zju.edu.cn> iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Tie IIO dma fence lock lifetime to the fence Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Make IIO DMA fence release RCU-safe Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Fix potential use-after-free in anonymous buffer release Cong Nguyen <congnt264(a)gmail.com> iio: adc: pac1921: fix wrong channel used in trigger handler read Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: adi-axi-adc: add data size support for AD408X backend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the Tegra264 register default table Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the MIXER enable default value Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort ADMAIF register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort MBDRC register defaults Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_mixer: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2780: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2764: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2552: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sti-sas: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sgtl5000: sort the register default table WenTao Liang <vulab(a)iscas.ac.cn> ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt721-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: drop duplicate reg_default entries Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-dmic: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt298: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt286: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt274: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1316-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1017-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pm4125-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pcm512x: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: ml26124: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: max9860: sort the register default table Binbin Zhou <zhoubinbin(a)loongson.cn> ASoC: loongson: Fix error handling in ACPI property parsing Haoxiang Li <haoxiang_li2024(a)163.com> AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: fsl_easrc: sort the register default table wangdicheng <wangdicheng(a)kylinos.cn> ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cx2072x: sort the register default table Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l33: drain threaded IRQ before runtime suspend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: adau1761: sort the register default table Linkai Gong <gonglinkai(a)kylinos.cn> i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Heiko Stuebner <heiko.stuebner(a)cherry.de> clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: align gxbb_32k_clk_sel number of parents with actual count Akari Tsuyukusa <akkun11.open(a)gmail.com> clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen Pavel Löbl <pavel(a)loebl.cz> clk: clocking-wizard: fix integer overflow in rate calculation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: avoid unaligned fault in IP extraction Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: linearize skbuff for packet generation Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: ensure unshared skb for multicast packets Zhiling Zou <zhilinz(a)nebusec.ai> batman-adv: fix stale receive device on merged fragments Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: rawnand: validate ONFI extended parameter page sections Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() Xu Rao <raoxu(a)uniontech.com> mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: afs: validate v2 image info bounds Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix NULL deref in status_show() during queue probe Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: stop watchdogs before booting kdump kernel Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Move H_WATCHDOG definitions to a common header Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Handle and log pseries-wdt registration failures Muchun Song <muchun.song(a)linux.dev> powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Fix null-ptr-def in extra size calculation Helge Deller <deller(a)gmx.de> parisc: Fix alignment of asm statements in head.S Pei Xiao <xiaopei01(a)kylinos.cn> parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas <hexlabsecurity(a)proton.me> nvdimm/btt: reject an arena whose nfree is below the lane count Narek Jilavyan <njilav(a)gmail.com> mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() Longlong Xia <xialonglong(a)kylinos.cn> mm/hugetlb: keep max_huge_pages when dissolving surplus folios Wupeng Ma <mawupeng1(a)huawei.com> mm/hugetlb: fix missing migratable flag on same-node hugetlb migration caina <caina(a)uniontech.com> Revert "irqchip/mbigen: Fix mbigen node address layout" Christian Marangi <ansuelsmth(a)gmail.com> pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Kazuki Hanai <hnkz.64(a)gmail.com> nvmet-auth: Synchronize timeout work during SQ teardown Tristan Madani <tristan(a)talencesecurity.com> nvme: add missing SRCU grace period in error path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: check the data direction of a C2HData PDU Niklas Cassel <cassel(a)kernel.org> nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Xu Rao <raoxu(a)uniontech.com> nvme-fabrics: fix DHCHAP secret leak on parse failure Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix race between non-atomic ops and trigger-start Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: harmony: initialize locks before requesting IRQ HyeongJun An <sammiee5311(a)gmail.com> ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Khushit Shah <khushit.shah(a)nutanix.com> arm64: errata: pass REVIDR when matching target implementation CPUs Karl Mehltretter <kmehltretter(a)gmail.com> arm64: mm: Fix the lockless page-table walk in show_pte() Ahmad Byagowi <ahmadexp(a)gmail.com> i2c: mux: Fix channel node leak on adapter add failure Vasileios Almpanis <vasilisalmpanis(a)gmail.com> i2c: core: fix debugfs UAF on adapter removal Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> i2c: qcom-geni: update frequency table to fix timing parameters Hongbo Yao <andy.xu(a)hj-micro.com> i2c: designware: Enable interrupt mask workaround for HJMC3001 Sizhe Liu <liusizhe5(a)huawei.com> perf hisi-ptt: Fix PTT trace TLP header parsing Viktor Malik <vmalik(a)redhat.com> perf trace: Refactor augmented_raw_syscalls using bpf_for Viktor Malik <vmalik(a)redhat.com> perf trace: Factor out BPF loop body Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Fix kernel address leakages in LBR stack Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt Shakeel Butt <shakeel.butt(a)linux.dev> memcg: make the v1 soft limit knob inert Shakeel Butt <shakeel.butt(a)linux.dev> memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: aiptek - validate raw macro indices before updating state HE WEI（ギカク） <skyexpoc(a)gmail.com> fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Nirbhay Sharma <nirbhay.lkd(a)gmail.com> fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Eric Dumazet <edumazet(a)google.com> mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> kprobes: Protect kprobe_blacklist with RCU Ju Nan <junan76(a)163.com> irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Bradley Morgan <brads(a)mainlining.org> ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Hajo Noerenberg <hajo-linux-ide(a)noerenberg.de> ata: ahci: work around lost interrupts on Marvell 88SE61xx Max Kellermann <max.kellermann(a)ionos.com> ceph: lock mutex in ceph_mds_check_access() Hui Su <sh_def(a)163.com> bpf: Fix infinite loop in pcpu_freelist push with one possible CPU Damien Le Moal <dlemoal(a)kernel.org> block: flag zoned disks with GENHD_FL_NO_PART Ulf Hansson <ulf.hansson(a)oss.qualcomm.com> cpuidle: psci: Fix support for probe deferral by dropping the faux device Linkai Gong <gonglinkai(a)kylinos.cn> cpuidle: dt_idle_genpd: kfree() the original name allocation Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Complete descriptors before pausing Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Fix HDMA channel status register access Martin Kaiser <martin(a)kaiser.cx> dmaengine: fsl-edma: tracing: no ptr dereference during log output Aneesh Kumar K.V (Arm) <aneesh.kumar(a)kernel.org> dma-direct: return struct page from dma_direct_alloc_from_pool() Mikulas Patocka <mpatocka(a)redhat.com> dm: fix resume-vs-remove race Mikulas Patocka <mpatocka(a)redhat.com> dm: fix race when loading and unloading a table Ibrahim Hashimov <security(a)auditcode.ai> HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie(a)gmail.com> HID: rmi: fix OOB access with undersized RMI reports Shen Yongchao <grayhat(a)foxmail.com> HID: bpf: serialize device reference release in struct_ops destroy path Steven Rostedt <rostedt(a)goodmis.org> ftrace: Synchronize the initialization of ftrace_ops Yao Kai <yaokai34(a)huawei.com> futex: Prevent rcuwait use-after-free during requeue PI SJ Park <sj(a)kernel.org> mm/damon/core-kunit: check region count before testing in split_at() SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() region and target (error) dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme region dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme filter dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs SJ Park <sj(a)kernel.org> samples/damon/wsse: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/wsse: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/prcl: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/prcl: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_stop() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_start() failure SJ Park <sj(a)kernel.org> mm/damon/vaddr-kunit: check region count in three_regions test Runyu Xiao <runyu.xiao(a)seu.edu.cn> scsi: pm8001: Use rollback index when freeing MSI-X vectors Thomas Lamprecht <t.lamprecht(a)proxmox.com> scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame Sujal Tuladhar <sujaltuladhar1231(a)gmail.com> scsi: target: iscsi: Reserve a terminator byte for the login payload Honghui Jiang <jiang_hh2019(a)163.com> spi: Fix DMA mapping ownership on partial map failure Can Peng <pengcan(a)kylinos.cn> spi: bcmbca-hsspi: disable clocks on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx: disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx-hsspi: disable clocks on resume failure Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size Kanishka De Silva <kpskanna1915(a)gmail.com> ublk: clear VM_MAYWRITE on read-only ublk char device mmap Bryan Lim <foxieflakey(a)gmail.com> userfaultfd: reset err to be 0 when move_pages_ptes succeeded Can Peng <pengcan(a)kylinos.cn> thermal/drivers/qoriq: Disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> thermal/drivers/imx: Disable clock on runtime resume failure Arthur Gautier <baloo(a)superbaloo.net> xhci: fix lost bounce buffers on TDs spanning several ring segments Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki <lovekeshsolanki00(a)gmail.com> USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_midi: initialize work in f_midi_alloc() Ivy Lopez <skunkolee(a)gmail.com> usb: gadget: f_midi2: fix use-after-free in string attribute show path Aleksandr Nogikh <nogikh(a)google.com> usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Jameson Thies <jthies(a)google.com> usb: typec: ucsi: displayport: Fix OOB altmode array index Sven Peter <sven(a)kernel.org> usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic: cancel reset_work on stop Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Myeonghun Pak <mhun512(a)gmail.com> usb: storage: realtek_cr: fix use-after-free on disconnect Elson Serrao <elson.serrao(a)oss.qualcomm.com> usb: dwc3: clear forceRM when issuing EndTransfer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Liu Qi <liuqi(a)longcheer.com> usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: usbtv: keep device alive while ALSA card exists Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset HyeongJun An <sammiee5311(a)gmail.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: image: mdc800: change kmalloc() to kzalloc() Hari Mishal <harimishal1(a)gmail.com> drm/amd/display: fix division by zero in get_estimated_bw() Anton Protopopov <a.s.protopopov(a)gmail.com> bpf: fix the return value of push_stack Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Sun Jian <sun.jian.kdev(a)gmail.com> fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Drop calls to restore power limit and clock from smu_resume() Ali Ahmet Memis <ali(a)iusegentoo.com> mfd: qnap-mcu: keep the reply buffer alive past a command timeout FUJITA Tomonori <fujita.tomonori(a)gmail.com> objtool/rust: add one more `noreturn` Rust function Youngjae Kwon <yjkwon0026(a)snu.ac.kr> fsnotify: Fix stale object mask after concurrent mark updates Jinjie Ruan <ruanjinjie(a)huawei.com> entry: Fix seccomp bypass after ptrace with TSYNC Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Yuqi Xu <xuyuqiabc(a)gmail.com> openvswitch: Fix CT limit teardown use-after-free Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() ------------- Diffstat: Documentation/ABI/testing/sysfs-kernel-mm-damon | 8 +- Documentation/admin-guide/cgroup-v1/memory.rst | 49 +-- Documentation/trace/hisi-ptt.rst | 28 +- .../media/v4l/ext-ctrls-colorimetry.rst | 12 +- Makefile | 4 +- arch/arm64/include/asm/kvm_nested.h | 20 ++ arch/arm64/kernel/cpu_errata.c | 2 +- arch/arm64/kvm/at.c | 2 - arch/arm64/kvm/nested.c | 94 ++++-- arch/arm64/kvm/sys_regs.c | 11 + arch/arm64/kvm/vgic/vgic-init.c | 1 + arch/arm64/kvm/vgic/vgic-its.c | 8 + arch/arm64/kvm/vgic/vgic-v3-nested.c | 2 +- arch/arm64/kvm/vgic/vgic-v3.c | 12 +- arch/arm64/mm/fault.c | 12 +- arch/loongarch/Kconfig | 2 +- arch/loongarch/include/asm/kvm_host.h | 1 + arch/loongarch/include/asm/pgtable.h | 7 + arch/loongarch/kernel/acpi.c | 3 +- arch/loongarch/kernel/kprobes.c | 3 + arch/loongarch/kernel/rethook_trampoline.S | 2 - arch/loongarch/kvm/exit.c | 1 - arch/loongarch/kvm/main.c | 6 +- arch/loongarch/kvm/mmu.c | 10 + arch/loongarch/kvm/vcpu.c | 6 +- arch/loongarch/kvm/vm.c | 1 + arch/loongarch/net/bpf_jit.c | 22 +- arch/parisc/kernel/head.S | 1 + arch/powerpc/include/asm/papr-watchdog.h | 64 ++++ arch/powerpc/include/asm/reg.h | 12 + arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/kexec/ranges.c | 12 +- arch/powerpc/kvm/book3s_hv.c | 15 +- arch/powerpc/kvm/powerpc.c | 6 + arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +- arch/powerpc/platforms/pseries/setup.c | 28 +- arch/s390/include/asm/nmi.h | 3 + arch/s390/kernel/nmi.c | 5 +- arch/s390/kvm/guestdbg.c | 9 +- arch/s390/kvm/interrupt.c | 26 +- arch/s390/kvm/kvm-s390.c | 15 +- arch/x86/events/intel/lbr.c | 12 +- arch/x86/kernel/rtc.c | 4 + arch/x86/kvm/hyperv.c | 25 +- arch/x86/kvm/mmu/mmu.c | 102 +++--- arch/x86/kvm/mmu/tdp_iter.h | 7 + arch/x86/kvm/mmu/tdp_mmu.c | 20 +- arch/x86/kvm/vmx/nested.c | 75 +++-- arch/x86/kvm/x86.c | 5 +- arch/x86/kvm/x86.h | 2 +- block/genhd.c | 7 + drivers/acpi/acpi_pnp.c | 2 +- drivers/acpi/acpi_tad.c | 186 +++++++---- drivers/acpi/cppc_acpi.c | 13 +- drivers/acpi/x86/cmos_rtc.c | 13 +- drivers/ata/ahci.c | 49 +++ drivers/block/ublk_drv.c | 6 + drivers/block/zram/zram_drv.c | 65 ++-- drivers/block/zram/zram_drv.h | 1 - drivers/clk/mediatek/Kconfig | 1 + drivers/clk/meson/gxbb.c | 2 +- drivers/clk/qcom/gcc-mdm9607.c | 182 +---------- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 4 +- drivers/cpufreq/apple-soc-cpufreq.c | 36 +-- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/cpuidle/cpuidle-psci.c | 42 +-- drivers/cpuidle/dt_idle_genpd.c | 3 +- drivers/crypto/atmel-ecc.c | 50 ++- drivers/crypto/intel/iaa/iaa_crypto_main.c | 138 ++++---- drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 + drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/cxl/core/Makefile | 1 + drivers/cxl/core/core.h | 11 +- drivers/cxl/core/mbox.c | 8 - drivers/cxl/core/mce.c | 27 +- drivers/cxl/core/pci.c | 115 ------- drivers/cxl/core/ras_rch.c | 136 ++++++++ drivers/cxl/core/region.c | 122 ++++--- drivers/cxl/cxl.h | 9 +- drivers/cxl/cxlmem.h | 2 - drivers/dax/Makefile | 3 +- drivers/dax/cxl.c | 27 +- drivers/dma/dw-edma/dw-edma-core.c | 23 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +- drivers/dma/fsl-edma-trace.h | 4 +- drivers/firmware/qcom/qcom_scm.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 56 ++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 13 + .../display/dc/link/protocols/link_dp_dpia_bw.c | 5 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 13 - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 +--- drivers/gpu/drm/i915/i915_pci.c | 3 + drivers/gpu/drm/msm/dsi/dsi_host.c | 12 + drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 13 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c | 191 +++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 17 + drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 86 ++++- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 129 +++----- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/disp.c | 64 ++++ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 9 + .../nouveau/nvkm/subdev/gsp/rm/r570/nvrm/disp.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 5 + drivers/gpu/drm/panel/panel-edp.c | 19 +- drivers/gpu/drm/panthor/panthor_fw.c | 22 +- drivers/gpu/drm/solomon/ssd130x.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sysfb/ofdrm.c | 8 +- drivers/gpu/drm/sysfb/simpledrm.c | 74 ++++- drivers/gpu/drm/xe/xe_vram.c | 26 +- drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +- drivers/hid/hid-mcp2221.c | 15 +- drivers/hid/hid-rmi.c | 46 ++- drivers/hid/hid-sony.c | 78 ++--- drivers/hid/wacom_wac.c | 13 + drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/i2c-core-base.c | 6 + drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/iio/adc/Kconfig | 1 + drivers/iio/adc/adi-axi-adc.c | 30 ++ drivers/iio/adc/pac1921.c | 2 +- drivers/iio/adc/ti-ads7138.c | 42 ++- drivers/iio/chemical/atlas-sensor.c | 19 +- drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/industrialio-buffer.c | 38 ++- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 10 +- drivers/iio/light/ltrf216a.c | 3 +- drivers/iio/light/opt4001.c | 37 +-- drivers/iio/light/opt4060.c | 5 +- drivers/iio/pressure/dps310.c | 3 +- drivers/iio/pressure/mpl115.c | 11 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/infiniband/hw/ionic/ionic_hw_stats.c | 95 +++--- drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 +- drivers/input/tablet/aiptek.c | 13 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 14 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-stm32mp-exti.c | 4 +- drivers/md/dm.c | 14 +- drivers/media/cec/core/cec-adap.c | 10 +- drivers/media/cec/core/cec-core.c | 2 - drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + .../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +- drivers/media/i2c/alvium-csi2.c | 2 +- drivers/media/i2c/imx355.c | 3 +- drivers/media/i2c/imx415.c | 4 +- drivers/media/i2c/ov02a10.c | 12 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 + drivers/media/pci/saa7164/saa7164-core.c | 8 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/venc.c | 2 - .../platform/chips-media/wave5/wave5-vpu-dec.c | 3 +- .../platform/chips-media/wave5/wave5-vpu-enc.c | 6 +- .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 6 +- .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 6 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/qcom/iris/iris_state.c | 2 +- drivers/media/platform/qcom/iris/iris_vidc.c | 11 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 5 + drivers/media/platform/rockchip/rkvdec/rkvdec.c | 4 +- drivers/media/rc/sunxi-cir.c | 9 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 + drivers/media/usb/usbtv/usbtv-audio.c | 11 + drivers/media/v4l2-core/v4l2-async.c | 1 - drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 ++- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/mfd/qnap-mcu.c | 13 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/nand/ecc-realtek.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 +- drivers/mtd/parsers/afs.c | 7 + drivers/nvdimm/btt.c | 8 + drivers/nvme/host/core.c | 3 + drivers/nvme/host/fabrics.c | 2 + drivers/nvme/host/fc.c | 26 +- drivers/nvme/host/tcp.c | 7 + drivers/nvme/target/auth.c | 6 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/nvmet.h | 2 + drivers/nvme/target/tcp.c | 10 + drivers/parisc/eisa.c | 5 + drivers/pci/controller/plda/pcie-starfive.c | 36 ++- drivers/pmdomain/mediatek/Kconfig | 5 +- drivers/power/supply/ab8500_fg.c | 32 +- drivers/remoteproc/qcom_q6v5_pas.c | 9 +- drivers/rtc/rtc-cmos.c | 10 + drivers/rtc/rtc-rzn1.c | 30 +- drivers/s390/crypto/vfio_ap_ops.c | 203 ++++++++---- drivers/scsi/fnic/fip.c | 2 +- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +- drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 6 +- drivers/scsi/qla2xxx/qla_bsg.c | 39 ++- drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_edif.c | 3 + drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 61 +++- drivers/scsi/qla2xxx/qla_inline.h | 13 + drivers/scsi/qla2xxx/qla_isr.c | 39 ++- drivers/scsi/qla2xxx/qla_mbx.c | 28 +- drivers/scsi/qla2xxx/qla_nvme.c | 31 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/soc/qcom/qcom-geni-se.c | 24 +- drivers/spi/spi-bcm63xx-hsspi.c | 8 +- drivers/spi/spi-bcm63xx.c | 6 +- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi.c | 34 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 + drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/thermal/imx_thermal.c | 9 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 21 +- drivers/usb/gadget/function/f_fs.c | 31 +- drivers/usb/gadget/function/f_mass_storage.c | 2 +- drivers/usb/gadget/function/f_midi.c | 2 +- drivers/usb/gadget/function/f_midi2.c | 17 +- drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/host/xhci-debugfs.c | 21 +- drivers/usb/host/xhci-hub.c | 117 ++++--- drivers/usb/host/xhci-mem.c | 34 +- drivers/usb/host/xhci-pci.c | 6 +- drivers/usb/host/xhci-ring.c | 40 ++- drivers/usb/host/xhci-tegra.c | 12 +- drivers/usb/host/xhci-trace.h | 5 + drivers/usb/host/xhci.c | 81 +++-- drivers/usb/host/xhci.h | 46 ++- drivers/usb/image/mdc800.c | 4 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/storage/realtek_cr.c | 9 +- .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 28 +- drivers/usb/typec/tipd/core.c | 17 +- drivers/usb/typec/tipd/tps6598x.h | 4 +- drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/watchdog/pseries-wdt.c | 53 +-- drivers/xen/balloon.c | 56 ++-- fs/afs/callback.c | 1 + fs/ceph/caps.c | 63 +++- fs/ceph/crypto.c | 46 ++- fs/ceph/mds_client.c | 71 +++- fs/ceph/mds_client.h | 2 + fs/ceph/super.h | 13 + fs/erofs/zutil.c | 2 + fs/f2fs/data.c | 5 +- fs/f2fs/dir.c | 7 +- fs/f2fs/file.c | 154 ++++++--- fs/f2fs/gc.c | 2 +- fs/f2fs/inline.c | 2 +- fs/f2fs/namei.c | 17 +- fs/f2fs/node.c | 9 +- fs/f2fs/sysfs.c | 7 +- fs/f2fs/xattr.c | 2 +- fs/fuse/args.h | 65 ++++ fs/fuse/cuse.c | 7 +- fs/fuse/dev.c | 44 +-- fs/fuse/dev_uring.c | 189 +++++++---- fs/fuse/file.c | 22 +- fs/fuse/fuse_i.h | 53 +-- fs/fuse/inode.c | 10 +- fs/lockd/svcsubs.c | 2 +- fs/nfsd/filecache.c | 115 +++---- fs/nfsd/netns.h | 11 +- fs/nfsd/nfs4proc.c | 139 ++++++-- fs/nfsd/nfs4state.c | 170 +++++++--- fs/nfsd/nfsctl.c | 25 +- fs/nfsd/nfsd.h | 15 - fs/nfsd/state.h | 2 +- fs/notify/fanotify/fanotify_user.c | 12 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ntfs3/frecord.c | 20 +- fs/ocfs2/dir.c | 71 +++- fs/overlayfs/dir.c | 1 - fs/pidfs.c | 136 +++++--- fs/smb/client/cifs_debug.c | 4 +- fs/smb/client/cifs_spnego.h | 2 - fs/smb/client/cifs_unicode.h | 3 - fs/smb/client/cifsfs.c | 5 +- fs/smb/client/cifsfs.h | 6 +- fs/smb/client/cifsglob.h | 10 +- fs/smb/client/cifsproto.h | 29 +- fs/smb/client/cifssmb.c | 146 +++++++++ fs/smb/client/compress.c | 21 +- fs/smb/client/compress.h | 19 +- fs/smb/client/connect.c | 142 -------- fs/smb/client/dir.c | 2 +- fs/smb/client/dns_resolve.h | 4 - fs/smb/client/fs_context.c | 2 +- fs/smb/client/fs_context.h | 16 +- fs/smb/client/fscache.h | 10 +- fs/smb/client/inode.c | 61 +++- fs/smb/client/misc.c | 1 + fs/smb/client/netmisc.c | 2 +- fs/smb/client/smb1ops.c | 171 ---------- fs/smb/client/smb1proto.h | 40 +++ fs/smb/client/smb1transport.c | 198 ++++++++++++ fs/smb/client/smb2file.c | 3 +- fs/smb/client/smb2inode.c | 1 - fs/smb/client/smb2maperror.c | 3 +- fs/smb/client/smb2ops.c | 99 ++++-- fs/smb/client/smb2pdu.c | 5 +- fs/smb/client/smb2proto.h | 14 +- fs/smb/client/trace.h | 151 +++++++++ fs/smb/server/oplock.c | 61 +++- include/linux/acpi.h | 14 + include/linux/firmware/qcom/qcom_scm.h | 10 +- include/linux/huge_mm.h | 7 +- include/linux/hugetlb.h | 5 + include/linux/kprobes.h | 1 + include/linux/lockd/lockd.h | 2 +- include/linux/memcontrol.h | 10 + include/linux/mm.h | 2 - include/linux/rmap.h | 9 +- include/linux/soc/qcom/geni-se.h | 4 + include/net/dst.h | 6 + include/net/ip.h | 25 ++ include/net/ip6_route.h | 43 +++ include/net/ipv6.h | 10 +- include/net/tcp.h | 5 + kernel/bpf/percpu_freelist.c | 35 +- kernel/bpf/percpu_freelist.h | 1 + kernel/bpf/stackmap.c | 173 ++++++---- kernel/bpf/verifier.c | 81 ++--- kernel/dma/direct.c | 18 +- kernel/entry/syscall-common.c | 3 + kernel/futex/requeue.c | 12 +- kernel/kprobes.c | 14 +- kernel/sched/core.c | 60 ++-- kernel/sched/deadline.c | 8 +- kernel/sched/ext.c | 17 +- kernel/sched/fair.c | 4 +- kernel/sched/idle.c | 2 +- kernel/sched/rt.c | 8 +- kernel/sched/sched.h | 12 +- kernel/sched/stop_task.c | 2 +- kernel/trace/ftrace.c | 13 +- kernel/trace/ring_buffer.c | 20 +- mm/damon/core.c | 22 +- mm/damon/ops-common.c | 5 +- mm/damon/paddr.c | 20 +- mm/damon/sysfs-schemes.c | 18 +- mm/damon/sysfs.c | 23 +- mm/damon/tests/core-kunit.h | 15 +- mm/damon/tests/vaddr-kunit.h | 5 + mm/damon/vaddr.c | 34 +- mm/huge_memory.c | 358 ++++++++++++--------- mm/hugetlb.c | 25 +- mm/hugetlb_cgroup.c | 7 +- mm/hugetlb_vmemmap.c | 298 +++++++---------- mm/memcontrol-v1.c | 43 ++- mm/memcontrol.c | 13 + mm/mempolicy.c | 2 +- mm/migrate.c | 12 +- mm/mm_init.c | 1 + mm/page_alloc.c | 6 +- mm/page_vma_mapped.c | 8 +- mm/rmap.c | 15 +- mm/slab.h | 8 +- mm/slab_common.c | 44 ++- mm/slub.c | 108 +++---- mm/sparse-vmemmap.c | 53 --- mm/userfaultfd.c | 4 +- mm/vmscan.c | 41 +-- net/8021q/vlan.c | 7 +- net/8021q/vlan_dev.c | 32 +- net/batman-adv/bridge_loop_avoidance.c | 15 +- net/batman-adv/distributed-arp-table.c | 8 +- net/batman-adv/main.c | 4 + net/batman-adv/multicast_forw.c | 7 +- net/core/skbuff.c | 5 +- net/ipv4/icmp.c | 2 +- net/ipv4/ip_output.c | 4 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ipmr.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ipv4.c | 15 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/exthdrs.c | 55 ++-- net/ipv6/ip6_gre.c | 2 +- net/ipv6/ip6_output.c | 47 +-- net/ipv6/ip6_tunnel.c | 6 +- net/ipv6/ipv6_sockglue.c | 4 +- net/ipv6/route.c | 10 +- net/ipv6/sit.c | 2 +- net/ipv6/tcp_ipv6.c | 11 +- net/openvswitch/conntrack.c | 121 ++++--- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 10 +- net/openvswitch/datapath.h | 8 +- net/packet/af_packet.c | 96 +++++- net/sunrpc/auth_gss/gss_rpc_xdr.c | 9 +- net/sunrpc/xprtrdma/ib_client.c | 26 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 5 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 32 +- rust/kernel/bug.rs | 10 +- rust/kernel/devres.rs | 163 ++++------ rust/kernel/drm/ioctl.rs | 6 + samples/damon/mtier.c | 14 +- samples/damon/prcl.c | 11 +- samples/damon/wsse.c | 11 +- security/integrity/ima/ima_appraise.c | 2 + sound/core/pcm_native.c | 2 + sound/core/rawmidi.c | 2 +- sound/parisc/harmony.c | 6 +- sound/soc/codecs/adau1761.c | 34 +- sound/soc/codecs/aw88261.c | 30 +- sound/soc/codecs/aw88261.h | 6 - sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/codecs/cx2072x.c | 134 ++++---- sound/soc/codecs/hdac_hda.c | 4 +- sound/soc/codecs/max9860.c | 2 +- sound/soc/codecs/ml26124.c | 4 +- sound/soc/codecs/pcm512x.c | 40 +-- sound/soc/codecs/pm4125-sdw.c | 2 +- sound/soc/codecs/rt1017-sdca-sdw.h | 10 +- sound/soc/codecs/rt1316-sdw.c | 2 +- sound/soc/codecs/rt1318-sdw.c | 2 +- sound/soc/codecs/rt1318.c | 4 +- sound/soc/codecs/rt274.c | 8 +- sound/soc/codecs/rt286.c | 14 +- sound/soc/codecs/rt298.c | 14 +- sound/soc/codecs/rt700-sdw.h | 11 +- sound/soc/codecs/rt711-sdca-sdw.h | 6 +- sound/soc/codecs/rt711-sdw.h | 10 +- sound/soc/codecs/rt712-sdca-dmic.h | 6 +- sound/soc/codecs/rt712-sdca-sdw.h | 11 +- sound/soc/codecs/rt715-sdca-sdw.h | 48 ++- sound/soc/codecs/rt715-sdw.h | 32 +- sound/soc/codecs/rt721-sdca-sdw.h | 44 +-- sound/soc/codecs/sgtl5000.c | 2 +- sound/soc/codecs/sti-sas.c | 2 +- sound/soc/codecs/tas2552.c | 14 +- sound/soc/codecs/tas2764.c | 2 +- sound/soc/codecs/tas2780.c | 2 +- sound/soc/codecs/tas2783-sdw.c | 177 +++++----- sound/soc/fsl/fsl_easrc.c | 8 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/loongson/loongson_card.c | 6 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/soc/tegra/tegra210_admaif.c | 210 ++++++++---- sound/soc/tegra/tegra210_i2s.c | 8 +- sound/soc/tegra/tegra210_mbdrc.c | 42 +-- sound/soc/tegra/tegra210_mixer.c | 10 +- sound/usb/midi.c | 2 + tools/objtool/check.c | 3 +- .../util/bpf_skel/augmented_raw_syscalls.bpf.c | 155 +++++---- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 +-- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 + tools/sched_ext/scx_qmap.bpf.c | 2 +- tools/testing/cxl/Kbuild | 1 + 511 files changed, 7548 insertions(+), 4554 deletions(-)

1 week, 1 day

[PATCH 7.2 000/556] 7.2.5-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.5 release. There are 556 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Sep 2026 13:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.5-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.5-rc1 Farhan Ali <alifm(a)linux.ibm.com> PCI: Allow per function PCI slots to fix slot reset on s390 Farhan Ali <alifm(a)linux.ibm.com> PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value SJ Park <sj(a)kernel.org> mm/damon/vaddr: drop last same folio access check optimization SJ Park <sj(a)kernel.org> mm/damon/paddr: drop last same folio access check reuse optimization SJ Park <sj(a)kernel.org> mm/damon/ops-common: use nr_accesses moving sum for quota score SJ Park <sj(a)kernel.org> mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ab8500_fg: fix use-after-free on remove Pan Chuang <panchuang(a)vivo.com> power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check Chuck Lever <cel(a)kernel.org> rpcrdma: arm rn_done before publishing the notification Jiri Olsa <jolsa(a)kernel.org> bpf: Disable preemption in bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Use stack id functions instead of __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_new_bucket from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_fastpath function from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_init function from __bpf_get_stackid Abdifatah Suruur <suruurism(a)gmail.com> ksmbd: fix use-after-free in oplock break notification Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: fix vblank interrupts on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix head state readback on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI vendor infoframes on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Faith Ekstrand <faith.ekstrand(a)collabora.com> drm/nouveau: Use write-combined maps for coherent Marek Czernohous <marek(a)czernohous.de> drm/nouveau: unsubscribe the channel-kill event before the fence context Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/dmem: fix callocated underflow on large folio split Matthew Brost <matthew.brost(a)intel.com> drm/pagemap: Fix folio allocation fallback and use-after-put Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve stride validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve panel-size validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve framebuffer-size validation Sunday Clement <Sunday.Clement(a)amd.com> drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram Mario Limonciello <mario.limonciello(a)amd.com> drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix error path at svm_migrate_copy_to_ram Priya Hosur <Priya.Hosur(a)amd.com> drm/amdkfd: Add TLB flush after MES queue eviction/suspension Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx12 userqueues Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx11 userqueues Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Skip accessing psp rum time db for APUs Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: force complete the MES ring fences on reset Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: force complete the KIQ ring fences on reset Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: fix Idle BOs list in VM debugfs status info Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump Guangshuo Li <lgs201920130244(a)gmail.com> drm/amdgpu: fix autosuspend cleanup during removal Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: Disable runtime PM for externally attached dGPUs Xiang Liu <xiang.liu(a)amd.com> drm/amdgpu: clamp the isolation index for rings outside a partition Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: delay ttm buffer func enablement on xgmi Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check thunderbolt before switcheroo registration Matthew Brost <matthew.brost(a)intel.com> drm/ttm: Drop tt->restore after successful restore Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Kavan Smith <kavansmith82(a)gmail.com> drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Tao Yu <tao1.yu(a)intel.com> drm/gud: validate TV mode names before creating enum property Deepanshu Kartikey <kartikey406(a)gmail.com> drm/gud: NUL-terminate TV mode names read from the device David (Ming Qiang) Wu <David.Wu3(a)amd.com> drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: only apply compute quantums to KCQs Roman Li <Roman.Li(a)amd.com> drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 Austin Zheng <Austin.Zheng(a)amd.com> drm/amd/display: Remove const Qualifier From Non-Pointer Fields Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: validate plane degamma LUT size for private color prop Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE Linkai Gong <gonglinkai(a)kylinos.cn> drm/amd/display: fix dc_lock leak on GPU reset error paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Use drm_atomic_helper_check_plane_state() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Fix list of formats on the primary plane Lyude Paul <lyude(a)redhat.com> drm/nouveau/disp/r535: Add scanline position support + head state support Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates in ssd133x Wentao Liang <vulab(a)iscas.ac.cn> drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates for ssd132x Deepanshu Kartikey <kartikey406(a)gmail.com> drm/i915: Guard against NULL driver_data in i915_pci_probe() Nemesa Garg <nemesa.garg(a)intel.com> drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable Danilo Krummrich <dakr(a)kernel.org> drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold <johan(a)kernel.org> drm/panel-edp: fix i2c adapter leak on probe failure Johan Hovold <johan(a)kernel.org> drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: fix firmware control interface bounds checks Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: harden firmware build-info bounds checks Matthew Auld <matthew.auld(a)intel.com> drm/xe/vram: report FLAT_CCS base misalignment Bob Zhou <bobzhou2(a)amd.com> drm/amdgpu: avoid force-completing uninitialized UVD rings Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Chao Yu <chao(a)kernel.org> f2fs: fix to zero post-EOF data when extending file size Chao Yu <chao(a)kernel.org> f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Chao Yu <chao(a)kernel.org> f2fs: fix to reclaim space in f2fs_allocate_pinning_section() Chen Changcheng <chenchangcheng(a)kylinos.cn> f2fs: fix valid block count leak on data block allocation failure Wenjie Qi <qwjhust(a)gmail.com> f2fs: protect critical_task_priority updates with s_umount Chao Yu <chao(a)kernel.org> f2fs: fix to clear dirty flag on folio in error path Chao Yu <chao(a)kernel.org> f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Chao Yu <chao(a)kernel.org> f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: fix i_size when pinned fallocate partially fails Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() Daeho Jeong <daehojeong(a)google.com> f2fs: fix to migrate all curseg types during free_segment_range Wenjie Qi <qwjhust(a)gmail.com> f2fs: avoid NULL checkpoint thread access in sysfs Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> f2fs: fix folio_nr_pages() race after put in large folio invalidate Guanghui Yang <3497809730(a)qq.com> f2fs: fix dentry folio leak in find_in_level Chao Yu <chao(a)kernel.org> f2fs: embed f2fs_gc_kthread in f2fs_sb_info Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential section-unaligned pinfile Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: don't drop the top folio order in the f2fs_iostat tracepoint Wenjie Qi <qwjhust(a)gmail.com> f2fs: limit recovery filename logging to stored length Wenjie Qi <qwjhust(a)gmail.com> f2fs: return writeback error from collapse range Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Joanne Chang <joannechien(a)google.com> f2fs: dirty directory inodes on mtime/ctime update Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate MOVE_RANGE destination size Chao Yu <chao(a)kernel.org> f2fs: fix to avoid move_range and defragment on device_alias file Wenjie Qi <qwjhust(a)gmail.com> f2fs: only redirty pinned folios in redirty_blocks Hao-Qun Huang <alvinhuang0603(a)gmail.com> f2fs: reject overlapping move range after len expansion Wenjie Qi <qwjhust(a)gmail.com> f2fs: return symlink writeback errors Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Quiesce response IRQ before freeing request queue Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Initialize NVMe abort_work once at submission Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix BSG job leak on validate flash image error path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Resume device before setting EOS flag Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Fix pipeline stall when queuing fails Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Add timeout while stop_streaming Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: avoid skipping device_run while VPU has work Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Set inst->std during default format initialization Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Guard bit depth check with initial_info_obtained Wangao Wang <wangao.wang(a)oss.qualcomm.com> media: qcom: iris: fix missing hfi_id in gen1 GOP_SIZE cap Hungyu Lin <dennylin0707(a)gmail.com> media: qcom: iris: use disable_irq() during power-off Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: qcom: iris: fix state-change debug log printing stale value Ruoyu Wang <ruoyuw560(a)gmail.com> media: zoran: Avoid freeing a registered video_device twice Arash Golgol <arash.golgol(a)gmail.com> media: vimc: fix pixel format lookup in enum_framesizes Uday Khare <udaykhare77(a)gmail.com> media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya <birenpandya(a)gmail.com> media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ming Qian <ming.qian(a)oss.nxp.com> media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Michael Bommarito <michael.bommarito(a)gmail.com> media: v4l2-ctrls: validate HEVC EXT SPS RPS counts Xu Rao <raoxu(a)uniontech.com> media: v4l2-async: avoid deleting unlinked ASC entry on link error Fan Wu <fanwu01(a)zju.edu.cn> media: ti: vpe: quiesce overflow recovery before freeing streams Ilya Krutskih <devsec(a)tpz.ru> media: tda18250: fix possible integer overflow Guangshuo Li <lgs201920130244(a)gmail.com> media: saa7164: fix cleanup on resource allocation failure Lei Huang <huanglei(a)kylinos.cn> media: s2255: check firmware size before reading trailing marker HyeongJun An <sammiee5311(a)gmail.com> media: s2255: bound JPEG frame size before copying into the buffer Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Michael Bommarito <michael.bommarito(a)gmail.com> media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow Michael Bommarito <michael.bommarito(a)gmail.com> media: rkvdec: hevc: tighten EXT SPS RPS control dimensions Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: rkvdec: Propagate platform_get_irq() errors Sven Püschel <s.pueschel(a)pengutronix.de> media: rockchip: rga: don't change RGB quantization Myeonghun Pak <mhun512(a)gmail.com> media: rc: sunxi-cir: Unregister rc device on probe failure David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix scaler factor overflow for large crop sizes David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix AEXP IHIST disable bit shift David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix clock leak on reset deassert failure David Carlier <devnexen(a)gmail.com> media: mali-c55: fix dropped last AEC histogram zone weight Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Correct color map between V4L2 and ISI Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Johan Hovold <johan(a)kernel.org> media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Guangshuo Li <lgs201920130244(a)gmail.com> media: platform: mtk-mdp3: Fix SCP device refcounting Christian Hewitt <christianshewitt(a)gmail.com> media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder José María Martín <jmmartinf(a)hotmail.com> media: ipu-bridge: check all DMI entries when overriding sensor rotation Cong Nguyen <congnt264(a)gmail.com> media: intel/ipu6: fix async notifier cleanup leak on parse error Dave Stevenson <dave.stevenson(a)raspberrypi.com> media: imx355: Avoid calling imx355_power_off twice in error path Benjamin Mugnier <benjamin.mugnier(a)foss.st.com> media: i2c: vd55g1: Fix media bus code initialization Benjamin Mugnier <benjamin.mugnier(a)foss.st.com> media: i2c: vd55g1: Fix manual digital gain on color variant Richard Leitner <richard.leitner(a)linux.dev> media: i2c: ov9282: restore flash duration calculation Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov7740: fix use-after-destroy in remove Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov02a10: fix endpoint parsing use-after-free Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Return test pattern write errors Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Release runtime PM reference on VBLANK error Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han <jiangong.han(a)windriver.com> media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> media: em28xx: defer audio-only extension registration Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP Fan Wu <fanwu01(a)zju.edu.cn> media: cx23885: cancel NetUP CI work before teardown Bryam Vargas <hexlabsecurity(a)proton.me> media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang <ruoyuw560(a)gmail.com> media: cobalt: Avoid freeing ALSA private data twice Dawei Feng <dawei.feng(a)seu.edu.cn> media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang <ruoyuw560(a)gmail.com> media: cec: Serialize exclusive follower delivery Yi Ding <yi.s.ding(a)gmail.com> media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Hans Verkuil <hverkuil+cisco(a)kernel.org> media: cec: extron-da-hd-4k-plus: add sanity check Biren Pandya <birenpandya(a)gmail.com> media: cec: disable delayed work before freeing an interrupted transmit Jonas Karlman <jonas(a)kwiboo.se> media: cec: core: Fix kmemleak due to missed rc_free_device() call Eugen Hristev <ehristev(a)kernel.org> media: bcm2835-unicam: Fix pipeline wrong validation for unpacked formats Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Remove obsolete frame_count check in venc_start_session Valery Borovsky <vebohr(a)gmail.com> media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Danilo Krummrich <dakr(a)kernel.org> rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> LoongArch: Avoid preempt count underflow without probe Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Do not save/restore percpu base register in rethook trampoline Nathan Chancellor <nathan(a)kernel.org> LoongArch: Do not select HAVE_RUST when KASAN is enabled Bibo Mao <maobibo(a)loongson.cn> LoongArch: Fix acpi_package_ids[] array overflow Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Fix off-by-one error for insn_is_cast_user() Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Move arena register slot below TCC context Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Expand module virtual address space to 2GB Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Refactor jump offset calculation in tail call Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Optimize redundant TCC loads in epilogue Han Gao <gaohan(a)iscas.ac.cn> LoongArch: Add DIRECT_MAP_PHYSMEM_END definition Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Validate MSI data before routing it to EIOINTC Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Free init resources if kvm_init() fails Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix TOCTOU race on pv_features Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Add unregister helpers for the KVM interrupt devices Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly cap TLBI Range to the architural limit Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure Kajetan Puchalski <kajetan.puchalski(a)arm.com> KVM: arm64: vgic: Fix detection of MI on no pending LR Qihang <q.h.hack.winter(a)gmail.com> KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables Marc Zyngier <maz(a)kernel.org> KVM: arm64: Sign-extend VA for range-based TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VM-wide VNCR mapping counter Marc Zyngier <maz(a)kernel.org> KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly handle end of VA space TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Restore sigset on error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: keyop: use mmu_lock to read gmap->asce Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize data structures for inject_pfault_token Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix length check __import_wp_info() Yosry Ahmed <yosry(a)kernel.org> KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Sean Christopherson <seanjc(a)google.com> KVM: x86: Serialize writes to disabled_quirks using kvm->lock Carlos López <clopez(a)suse.de> KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU Yosry Ahmed <yosry(a)kernel.org> KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Always flush vpid02 on first use Amit Machhiwal <amachhiw(a)linux.ibm.com> KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Reject integration times with a non-zero seconds part Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix power down clearing bits of the wrong register Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Fix incorrect register name in threshold read error message Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Reject integration times with a non-zero seconds part Paul Geurts <paul.geurts(a)prodrive-technologies.com> iio: ti-ads7138: Disable STATS_EN bit while reading conversion results Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen <congnt264(a)gmail.com> iio: srf04: fix pm_runtime handling on probe error path Can Peng <pengcan(a)kylinos.cn> iio: pressure: mpl115: Fix runtime PM cleanup Rupesh Majhi <zoone.rupert(a)gmail.com> iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: ltrf216a: fix runtime PM reference leak in error path Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze <giorgi(a)tchankvetadze.com> iio: light: cm32181: return zero after writing calibscale Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: light: apds9306: fix PM reference leak in apds9306_read_data() Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion Cong Nguyen <congnt264(a)gmail.com> iio: gyro: mpu3050: fix sign of raw angular velocity readings Joshua Crofts <joshua.crofts1(a)gmail.com> iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig Erick Henrique <erick.henrique.rodrigues(a)usp.br> iio: dac: m62332: Fix regulator reference count imbalance Can Peng <pengcan(a)kylinos.cn> iio: dac: ad5446: fix OF module device table Babanpreet Singh <bbnpreetsingh(a)gmail.com> iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show Linmao Li <lilinmao(a)kylinos.cn> iio: chemical: sgp30: Handle IAQ thread creation failure Fan Wu <fanwu01(a)zju.edu.cn> iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Tie IIO dma fence lock lifetime to the fence Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Make IIO DMA fence release RCU-safe Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Fix potential use-after-free in anonymous buffer release Cong Nguyen <congnt264(a)gmail.com> iio: adc: pac1921: fix wrong channel used in trigger handler read Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max14001: add missing 'select REGMAP' to Kconfig Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: adi-axi-adc: add data size support for AD408X backend Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ad4080: configure backend data size Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2780: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2764: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2552: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sti-sas: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sgtl5000: sort the register default table WenTao Liang <vulab(a)iscas.ac.cn> ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt721-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: drop duplicate reg_default entries Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-dmic: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt298: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt286: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt274: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1316-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1017-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pm4125-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pcm512x: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: ml26124: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: max9860: sort the register default table Binbin Zhou <zhoubinbin(a)loongson.cn> ASoC: loongson: Fix error handling in ACPI property parsing Haoxiang Li <haoxiang_li2024(a)163.com> AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: fsl_easrc: sort the register default table wangdicheng <wangdicheng(a)kylinos.cn> ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cx2072x: sort the register default table Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l33: drain threaded IRQ before runtime suspend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: adau1761: sort the register default table Linkai Gong <gonglinkai(a)kylinos.cn> i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Heiko Stuebner <heiko.stuebner(a)cherry.de> clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Pedro Kopper <pedro.kopper(a)microchip.com> clk: microchip: mpfs: fix regmap_update_bits() mask/val order Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: align gxbb_32k_clk_sel number of parents with actual count Akari Tsuyukusa <akkun11.open(a)gmail.com> clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen Pavel Löbl <pavel(a)loebl.cz> clk: clocking-wizard: fix integer overflow in rate calculation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: avoid unaligned fault in IP extraction Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: linearize skbuff for packet generation Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: ensure unshared skb for multicast packets Sven Eckelmann <sven(a)narfation.org> batman-adv: fix TX priority extraction for BATADV_FORW_MCAST Zhiling Zou <zhilinz(a)nebusec.ai> batman-adv: fix stale receive device on merged fragments Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: rawnand: validate ONFI extended parameter page sections James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: fix H6/H616 controller timings James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: describe tADL and tWHR delays James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: group controller delay tables Miquel Raynal (DAVE) <miquel.raynal(a)bootlin.com> mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() Xu Rao <raoxu(a)uniontech.com> mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: afs: validate v2 image info bounds Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix NULL deref in status_show() during queue probe Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: stop watchdogs before booting kdump kernel Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Move H_WATCHDOG definitions to a common header Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Handle and log pseries-wdt registration failures Muchun Song <muchun.song(a)linux.dev> powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Fix null-ptr-def in extra size calculation Helge Deller <deller(a)gmx.de> parisc: Fix alignment of asm statements in head.S Pei Xiao <xiaopei01(a)kylinos.cn> parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas <hexlabsecurity(a)proton.me> nvdimm/btt: reject an arena whose nfree is below the lane count Narek Jilavyan <njilav(a)gmail.com> mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() Longlong Xia <xialonglong(a)kylinos.cn> mm/hugetlb: keep max_huge_pages when dissolving surplus folios Sourav Panda <souravpanda(a)google.com> mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio Wupeng Ma <mawupeng1(a)huawei.com> mm/hugetlb: fix missing migratable flag on same-node hugetlb migration Hui Su <sh_def(a)163.com> mm/migrate_device: avoid out-of-bounds writes for compound folios Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs Abel Vesa <abel.vesa(a)oss.qualcomm.com> Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza" Eric Dumazet <edumazet(a)google.com> Revert "once: don't use a work queue to reset sleepable static key" caina <caina(a)uniontech.com> Revert "irqchip/mbigen: Fix mbigen node address layout" Christian Marangi <ansuelsmth(a)gmail.com> pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Kazuki Hanai <hnkz.64(a)gmail.com> nvmet-auth: Synchronize timeout work during SQ teardown Chao Shi <coshi036(a)gmail.com> nvme: skip the zoned limits update if the zone info query failed Tristan Madani <tristan(a)talencesecurity.com> nvme: add missing SRCU grace period in error path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: check the data direction of a C2HData PDU Niklas Cassel <cassel(a)kernel.org> nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Xu Rao <raoxu(a)uniontech.com> nvme-fabrics: fix DHCHAP secret leak on parse failure GuoHan Zhao <zhaoguohan(a)kylinos.cn> accel/ethosu: fix job completion fence cleanup GuoHan Zhao <zhaoguohan(a)kylinos.cn> accel/ethosu: check MMIO mapping errors in probe Taimuraz Kaitmazov <taimuraz(a)kaitmazov.com> accel/amdxdna: return early from a zero-length flush Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Allow splice reads on static buffers Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix race between non-atomic ops and trigger-start Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: harmony: initialize locks before requesting IRQ HyeongJun An <sammiee5311(a)gmail.com> ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Khushit Shah <khushit.shah(a)nutanix.com> arm64: errata: pass REVIDR when matching target implementation CPUs Fuad Tabba <fuad.tabba(a)linux.dev> arm64: Don't read GMID_EL1 when MTE is disabled Karl Mehltretter <kmehltretter(a)gmail.com> arm64: mm: Fix the lockless page-table walk in show_pte() Guangshuo Li <lgs201920130244(a)gmail.com> i2c: qcom-cci: fix autosuspend cleanup Ahmad Byagowi <ahmadexp(a)gmail.com> i2c: mux: Fix channel node leak on adapter add failure Vasileios Almpanis <vasilisalmpanis(a)gmail.com> i2c: core: fix debugfs UAF on adapter removal Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> i2c: qcom-geni: update frequency table to fix timing parameters Hongbo Yao <andy.xu(a)hj-micro.com> i2c: designware: Enable interrupt mask workaround for HJMC3001 Yilin Zhang <yilinzhang(a)moonshot.ai> perf: Fix use-after-free when perf mmap() revival races with the last munmap() Haiyong Sun <sunhaiyong(a)loongson.cn> perf build: Add clang and rust target flags for LoongArch Sizhe Liu <liusizhe5(a)huawei.com> perf hisi-ptt: Fix PTT trace TLP header parsing Viktor Malik <vmalik(a)redhat.com> perf trace: Refactor augmented_raw_syscalls using bpf_for Viktor Malik <vmalik(a)redhat.com> perf trace: Factor out BPF loop body Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Fix kernel address leakages in LBR stack Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt Shakeel Butt <shakeel.butt(a)linux.dev> memcg: make the v1 soft limit knob inert Shakeel Butt <shakeel.butt(a)linux.dev> memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done Shakeel Butt <shakeel.butt(a)linux.dev> memcg: keep folio's objcg same as its node Eric Dumazet <edumazet(a)google.com> mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Usama Arif <usama.arif(a)linux.dev> mm/huge_memory: transfer the pmd dirty bit to the folio on zap Baineng Shou <shoubaineng(a)gmail.com> misc: fastrpc: don't publish fd before copy_to_user() succeeds Masami Hiramatsu (Google) <mhiramat(a)kernel.org> kprobes: Protect kprobe_blacklist with RCU Ju Nan <junan76(a)163.com> irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Bradley Morgan <brads(a)mainlining.org> ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Hajo Noerenberg <hajo-linux-ide(a)noerenberg.de> ata: ahci: work around lost interrupts on Marvell 88SE61xx Max Kellermann <max.kellermann(a)ionos.com> ceph: lock mutex in ceph_mds_check_access() Hui Su <sh_def(a)163.com> bpf: Fix infinite loop in pcpu_freelist push with one possible CPU Chen Pei <cp0613(a)linux.alibaba.com> bpf, riscv: Make arena support depend on ZACAS Damien Le Moal <dlemoal(a)kernel.org> block: flag zoned disks with GENHD_FL_NO_PART Ulf Hansson <ulf.hansson(a)oss.qualcomm.com> cpuidle: psci: Fix support for probe deferral by dropping the faux device Linkai Gong <gonglinkai(a)kylinos.cn> cpuidle: dt_idle_genpd: kfree() the original name allocation Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Mark emulated IRQ as level-triggered Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Complete descriptors before pausing Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Fix HDMA channel status register access Martin Kaiser <martin(a)kaiser.cx> dmaengine: fsl-edma: tracing: no ptr dereference during log output Aneesh Kumar K.V (Arm) <aneesh.kumar(a)kernel.org> dma-direct: return struct page from dma_direct_alloc_from_pool() Baineng Shou <shoubaineng(a)gmail.com> dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds Mikulas Patocka <mpatocka(a)redhat.com> dm: fix resume-vs-remove race Mikulas Patocka <mpatocka(a)redhat.com> dm: fix race when loading and unloading a table Ibrahim Hashimov <security(a)auditcode.ai> HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie(a)gmail.com> HID: rmi: fix OOB access with undersized RMI reports Shen Yongchao <grayhat(a)foxmail.com> HID: bpf: serialize device reference release in struct_ops destroy path Steven Rostedt <rostedt(a)goodmis.org> ftrace: Synchronize the initialization of ftrace_ops Steven Rostedt <rostedt(a)goodmis.org> ftrace: Take trace_array reference before accessing its ftrace_ops Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling Yao Kai <yaokai34(a)huawei.com> futex: Prevent rcuwait use-after-free during requeue PI Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/secretmem: properly account locked pages SJ Park <sj(a)kernel.org> mm/damon/core: initialize damos->last_applied SJ Park <sj(a)kernel.org> mm/damon/core: handle region split failure in apply_min_nr_regions() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong region walk in commit_target_regions() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: handle region split failure in filter_out() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: check region count before testing in split_at() SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() region and target (error) dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme region dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme filter dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs SJ Park <sj(a)kernel.org> samples/damon/wsse: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/wsse: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/prcl: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/prcl: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_stop() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_start() failure SJ Park <sj(a)kernel.org> mm/damon/vaddr-kunit: check region count in three_regions test SJ Park <sj(a)kernel.org> mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() Song Hu <husong(a)kylinos.cn> Docs/ABI/damon: fix typo in intervals_goal sysfs path Runyu Xiao <runyu.xiao(a)seu.edu.cn> scsi: pm8001: Use rollback index when freeing MSI-X vectors Thomas Lamprecht <t.lamprecht(a)proxmox.com> scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame Rahul Chandelkar <rc(a)rexion.ai> scsi: bsg: Fix TOCTOU in io_uring passthrough command setup Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: bsg: Cap io_uring sense copy to max_response_len Sujal Tuladhar <sujaltuladhar1231(a)gmail.com> scsi: target: iscsi: Reserve a terminator byte for the login payload Honghui Jiang <jiang_hh2019(a)163.com> spi: Fix DMA mapping ownership on partial map failure Can Peng <pengcan(a)kylinos.cn> spi: bcmbca-hsspi: disable clocks on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx: disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx-hsspi: disable clocks on resume failure Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size Paul Louvel <paul.louvel(a)bootlin.com> soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler Kanishka De Silva <kpskanna1915(a)gmail.com> ublk: clear VM_MAYWRITE on read-only ublk char device mmap Bryan Lim <foxieflakey(a)gmail.com> userfaultfd: reset err to be 0 when move_pages_ptes succeeded Steven Rostedt <rostedt(a)goodmis.org> tracing: Take trace_array reference when opening options file Steven Rostedt <rostedt(a)goodmis.org> tracing: Have show_event_filters/triggers files take trace array ref Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member Can Peng <pengcan(a)kylinos.cn> thermal/drivers/qoriq: Disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> thermal/drivers/imx: Disable clock on runtime resume failure Arthur Gautier <baloo(a)superbaloo.net> xhci: fix lost bounce buffers on TDs spanning several ring segments Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki <lovekeshsolanki00(a)gmail.com> USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_midi: initialize work in f_midi_alloc() Ivy Lopez <skunkolee(a)gmail.com> usb: gadget: f_midi2: fix use-after-free in string attribute show path Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Aleksandr Nogikh <nogikh(a)google.com> usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Jameson Thies <jthies(a)google.com> usb: typec: ucsi: displayport: Fix OOB altmode array index Sven Peter <sven(a)kernel.org> usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic: cancel reset_work on stop Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Marek Vasut <marex(a)nabladev.com> usb: typec: mux: Fix typec_switch_match() Marek Vasut <marex(a)nabladev.com> usb: typec: mux: avoid duplicated mux switches Chang Wu <kunjinkao.jp(a)gmail.com> usb: typec: hd3ss3220: track VBUS enable state per consumer Myeonghun Pak <mhun512(a)gmail.com> usb: storage: realtek_cr: fix use-after-free on disconnect Elson Serrao <elson.serrao(a)oss.qualcomm.com> usb: dwc3: clear forceRM when issuing EndTransfer Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix wakeup from S3 after controller context loss Liu Qi <liuqi(a)longcheer.com> usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: usbtv: keep device alive while ALSA card exists Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset HyeongJun An <sammiee5311(a)gmail.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: image: mdc800: change kmalloc() to kzalloc() Hari Mishal <harimishal1(a)gmail.com> drm/amd/display: fix division by zero in get_estimated_bw() Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during blocked-lock reaping Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during close_lru reaping Chuck Lever <cel(a)kernel.org> NFSD: Consolidate the revocation-path client unpin Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during export state revocation Chuck Lever <cel(a)kernel.org> NFSD: Guard admin state-revocation walks with NFSD_NET_UP Chuck Lever <cel(a)kernel.org> NFSD: Annotate caller preconditions for the state-table walkers Sean Christopherson <seanjc(a)google.com> KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Rong Zhang <i(a)rong.moe> ACPI: battery: Protect all properties with a separated mutex Rong Zhang <i(a)rong.moe> ACPI: battery: Use kstrtoul() over sscanf("%lu\n") Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: clean up device list on probe failure Rosalie Wanders <rosalie(a)mailbox.org> HID: sony: use guard() and scoped_guard() Sam Edwards <cfsworks(a)gmail.com> ceph: properly decrypt filenames in vmalloc() buffers David Carlier <devnexen(a)gmail.com> zram: fix slot lock bit position on big-endian 64-bit Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> zram: move lockmap to be per-zram instead per table Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Fix Use-After-Free in AIO error path Gabriel Prostitis <prostitisgabriel(a)gmail.com> USB: gadget: ffs: fix mm lifetime handling Brendan Jackman <brendan.jackman(a)linux.dev> mm/page_alloc: don't spin_trylock() in NMI on UP Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM HE WEI（ギカク） <skyexpoc(a)gmail.com> fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() ------------- Diffstat: Documentation/ABI/testing/sysfs-kernel-mm-damon | 8 +- Documentation/admin-guide/cgroup-v1/memory.rst | 49 +---- .../devicetree/bindings/media/nxp,imx8-isi.yaml | 4 +- Documentation/trace/hisi-ptt.rst | 28 +-- .../media/v4l/ext-ctrls-colorimetry.rst | 12 +- Makefile | 4 +- arch/arm64/include/asm/cpu.h | 1 + arch/arm64/include/asm/cpufeature.h | 7 - arch/arm64/include/asm/kvm_host.h | 3 - arch/arm64/include/asm/kvm_nested.h | 20 ++ arch/arm64/kernel/cpu_errata.c | 2 +- arch/arm64/kernel/cpufeature.c | 33 +++- arch/arm64/kernel/cpuinfo.c | 2 +- arch/arm64/kvm/at.c | 2 - arch/arm64/kvm/hyp/vhe/switch.c | 3 +- arch/arm64/kvm/nested.c | 139 +++++++++----- arch/arm64/kvm/sys_regs.c | 11 ++ arch/arm64/kvm/vgic/vgic-init.c | 1 + arch/arm64/kvm/vgic/vgic-its.c | 8 + arch/arm64/kvm/vgic/vgic-v3-nested.c | 2 +- arch/arm64/kvm/vgic/vgic-v3.c | 12 +- arch/arm64/mm/fault.c | 12 +- arch/loongarch/Kconfig | 2 +- arch/loongarch/include/asm/kvm_dmsintc.h | 1 + arch/loongarch/include/asm/kvm_eiointc.h | 1 + arch/loongarch/include/asm/kvm_host.h | 1 + arch/loongarch/include/asm/kvm_ipi.h | 1 + arch/loongarch/include/asm/kvm_pch_pic.h | 1 + arch/loongarch/include/asm/pgtable.h | 9 +- arch/loongarch/kernel/acpi.c | 3 +- arch/loongarch/kernel/kprobes.c | 3 + arch/loongarch/kernel/rethook_trampoline.S | 2 - arch/loongarch/kvm/exit.c | 1 - arch/loongarch/kvm/intc/dmsintc.c | 8 +- arch/loongarch/kvm/intc/eiointc.c | 5 + arch/loongarch/kvm/intc/ipi.c | 5 + arch/loongarch/kvm/intc/pch_pic.c | 8 + arch/loongarch/kvm/main.c | 39 +++- arch/loongarch/kvm/mmu.c | 10 + arch/loongarch/kvm/vcpu.c | 8 +- arch/loongarch/kvm/vm.c | 1 + arch/loongarch/mm/init.c | 17 +- arch/loongarch/net/bpf_jit.c | 40 ++-- arch/parisc/kernel/head.S | 1 + arch/powerpc/include/asm/papr-watchdog.h | 64 +++++++ arch/powerpc/include/asm/reg.h | 12 ++ arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/kexec/ranges.c | 12 +- arch/powerpc/kvm/book3s_hv.c | 15 +- arch/powerpc/kvm/powerpc.c | 6 + arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +- arch/powerpc/platforms/pseries/setup.c | 28 ++- arch/riscv/net/bpf_jit_comp64.c | 10 +- arch/s390/include/asm/nmi.h | 3 + arch/s390/kernel/nmi.c | 5 +- arch/s390/kvm/guestdbg.c | 9 +- arch/s390/kvm/interrupt.c | 26 +-- arch/s390/kvm/kvm-s390.c | 22 ++- arch/x86/events/intel/core.c | 10 +- arch/x86/events/intel/lbr.c | 12 +- arch/x86/events/perf_event.h | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 4 + arch/x86/include/asm/kvm_host.h | 6 + arch/x86/kvm/hyperv.c | 25 ++- arch/x86/kvm/mmu/mmu.c | 107 ++++++----- arch/x86/kvm/mmu/tdp_iter.h | 7 + arch/x86/kvm/mmu/tdp_mmu.c | 20 +- arch/x86/kvm/svm/sev.c | 80 ++++++-- arch/x86/kvm/svm/svm.c | 6 +- arch/x86/kvm/svm/svm.h | 2 + arch/x86/kvm/vmx/nested.c | 75 ++++---- arch/x86/kvm/x86.c | 17 +- arch/x86/kvm/x86.h | 2 +- block/genhd.c | 7 + drivers/accel/amdxdna/amdxdna_gem.c | 3 + drivers/accel/ethosu/ethosu_drv.c | 2 + drivers/accel/ethosu/ethosu_job.c | 10 +- drivers/acpi/battery.c | 155 +++++++++++----- drivers/ata/ahci.c | 49 +++++ drivers/block/ublk_drv.c | 6 + drivers/block/zram/zram_drv.c | 27 ++- drivers/block/zram/zram_drv.h | 16 +- drivers/clk/mediatek/Kconfig | 1 + drivers/clk/meson/gxbb.c | 2 +- drivers/clk/microchip/clk-mpfs.c | 2 +- drivers/clk/qcom/gcc-mdm9607.c | 182 +----------------- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 4 +- drivers/cpuidle/cpuidle-psci.c | 42 ++--- drivers/cpuidle/dt_idle_genpd.c | 3 +- drivers/dma-buf/dma-buf.c | 20 ++ drivers/dma-buf/dma-heap.c | 80 ++++---- drivers/dma/dw-edma/dw-edma-core.c | 24 ++- drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +- drivers/dma/fsl-edma-trace.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 59 +++++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 23 ++- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 56 ++++-- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 13 ++ .../dml21/src/dml2_core/dml2_core_shared_types.h | 4 +- .../display/dc/dml2_0/dml2_translation_helper.c | 1 + drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- .../display/dc/link/protocols/link_dp_dpia_bw.c | 5 + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +++- drivers/gpu/drm/drm_pagemap.c | 128 ++++++++++--- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 ++---- drivers/gpu/drm/i915/display/intel_cursor.c | 15 +- drivers/gpu/drm/i915/display/skl_universal_plane.c | 15 +- drivers/gpu/drm/i915/i915_pci.c | 3 + drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++ drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 18 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 13 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c | 191 +++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 17 ++ drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 86 ++++++++- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 129 ++++++------- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/disp.c | 64 +++++++ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 9 + .../nouveau/nvkm/subdev/gsp/rm/r570/nvrm/disp.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 5 + drivers/gpu/drm/panel/panel-edp.c | 19 +- drivers/gpu/drm/panthor/panthor_fw.c | 22 ++- drivers/gpu/drm/solomon/ssd130x.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sysfb/ofdrm.c | 8 +- drivers/gpu/drm/sysfb/simpledrm.c | 74 ++++++-- drivers/gpu/drm/ttm/ttm_pool.c | 15 +- drivers/gpu/drm/xe/xe_vram.c | 26 ++- drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +- drivers/hid/hid-rmi.c | 46 ++++- drivers/hid/hid-sony.c | 87 ++++----- drivers/hid/wacom_wac.c | 13 ++ drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- drivers/i2c/busses/i2c-qcom-cci.c | 11 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/i2c-core-base.c | 6 + drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/iio/adc/Kconfig | 2 + drivers/iio/adc/ad4080.c | 5 + drivers/iio/adc/adi-axi-adc.c | 30 +++ drivers/iio/adc/pac1921.c | 2 +- drivers/iio/adc/ti-ads7138.c | 42 ++++- drivers/iio/chemical/atlas-sensor.c | 19 +- drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/Kconfig | 1 + drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/dac/ad5446-i2c.c | 2 +- drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_fusion.c | 5 + drivers/iio/industrialio-buffer.c | 38 ++-- drivers/iio/light/apds9306.c | 8 +- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 10 +- drivers/iio/light/ltrf216a.c | 3 +- drivers/iio/light/opt4001.c | 37 ++-- drivers/iio/light/opt4060.c | 5 +- drivers/iio/pressure/dps310.c | 3 +- drivers/iio/pressure/mpl115.c | 11 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-stm32mp-exti.c | 4 +- drivers/md/dm.c | 14 +- drivers/media/cec/core/cec-adap.c | 10 +- drivers/media/cec/core/cec-core.c | 2 - drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + .../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 ++- drivers/media/i2c/alvium-csi2.c | 2 +- drivers/media/i2c/imx355.c | 3 +- drivers/media/i2c/imx415.c | 4 +- drivers/media/i2c/ov02a10.c | 12 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/ov9282.c | 3 +- drivers/media/i2c/vd55g1.c | 32 +++- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/pci/intel/ipu-bridge.c | 8 +- drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 + drivers/media/pci/saa7164/saa7164-core.c | 8 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/venc.c | 2 - .../media/platform/arm/mali-c55/mali-c55-core.c | 2 + .../media/platform/arm/mali-c55/mali-c55-params.c | 1 + .../platform/arm/mali-c55/mali-c55-registers.h | 2 +- .../media/platform/arm/mali-c55/mali-c55-resizer.c | 2 +- drivers/media/platform/broadcom/bcm2835-unicam.c | 3 +- .../platform/chips-media/wave5/wave5-vpu-dec.c | 64 +++++-- .../platform/chips-media/wave5/wave5-vpu-enc.c | 6 +- .../platform/chips-media/wave5/wave5-vpuconfig.h | 2 +- .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 6 +- .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 6 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/qcom/iris/iris_ctrls.c | 2 +- drivers/media/platform/qcom/iris/iris_hfi_gen1.c | 16 +- .../platform/qcom/iris/iris_platform_common.h | 1 - drivers/media/platform/qcom/iris/iris_state.c | 2 +- drivers/media/platform/qcom/iris/iris_vidc.c | 11 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 5 + drivers/media/platform/rockchip/rga/rga3-hw.c | 12 +- .../platform/rockchip/rkvdec/rkvdec-hevc-common.c | 3 + drivers/media/platform/rockchip/rkvdec/rkvdec.c | 8 +- drivers/media/platform/ti/vpe/vip.c | 37 +++- drivers/media/rc/sunxi-cir.c | 9 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 ++ drivers/media/usb/usbtv/usbtv-audio.c | 11 ++ drivers/media/v4l2-core/v4l2-async.c | 1 - drivers/media/v4l2-core/v4l2-ctrls-core.c | 64 +++++-- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/misc/fastrpc.c | 16 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/nand/ecc-realtek.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 ++- drivers/mtd/nand/raw/pl35x-nand-controller.c | 5 +- drivers/mtd/nand/raw/sunxi_nand.c | 113 +++++++++--- drivers/mtd/parsers/afs.c | 7 + drivers/nvdimm/btt.c | 8 + drivers/nvme/host/core.c | 24 ++- drivers/nvme/host/fabrics.c | 2 + drivers/nvme/host/fc.c | 26 ++- drivers/nvme/host/tcp.c | 7 + drivers/nvme/target/auth.c | 6 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/nvmet.h | 2 + drivers/nvme/target/tcp.c | 10 + drivers/parisc/eisa.c | 5 + drivers/pci/hotplug/pnv_php.c | 2 +- drivers/pci/hotplug/rpaphp_slot.c | 2 +- drivers/pci/pci.c | 5 +- drivers/pci/slot.c | 50 +++-- drivers/pmdomain/mediatek/Kconfig | 5 +- drivers/pmdomain/qcom/rpmhpd.c | 4 - drivers/power/supply/ab8500_fg.c | 32 ++-- drivers/remoteproc/qcom_q6v5_pas.c | 13 +- drivers/rtc/rtc-rzn1.c | 30 ++- drivers/s390/crypto/vfio_ap_ops.c | 203 ++++++++++++++------- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +- drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 6 +- drivers/scsi/qla2xxx/qla_bsg.c | 46 +++-- drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_edif.c | 3 + drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 61 ++++++- drivers/scsi/qla2xxx/qla_inline.h | 13 ++ drivers/scsi/qla2xxx/qla_isr.c | 39 +++- drivers/scsi/qla2xxx/qla_mbx.c | 28 ++- drivers/scsi/qla2xxx/qla_nvme.c | 31 +++- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/scsi_bsg.c | 47 +++-- drivers/soc/fsl/qe/qe_ports_ic.c | 7 + drivers/soc/qcom/qcom-geni-se.c | 24 +-- drivers/spi/spi-bcm63xx-hsspi.c | 8 +- drivers/spi/spi-bcm63xx.c | 6 +- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi.c | 34 ++-- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 + drivers/staging/rtl8723bs/core/rtw_mlme.c | 3 + drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/thermal/imx_thermal.c | 9 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/usb/cdns3/cdnsp-gadget.c | 111 ++++++++++- drivers/usb/cdns3/cdnsp-gadget.h | 1 + drivers/usb/cdns3/cdnsp-mem.c | 98 ++++------ drivers/usb/dwc3/dwc3-google.c | 1 + drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 21 ++- drivers/usb/gadget/function/f_fs.c | 31 +++- drivers/usb/gadget/function/f_mass_storage.c | 5 +- drivers/usb/gadget/function/f_midi.c | 2 +- drivers/usb/gadget/function/f_midi2.c | 17 +- drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/host/xhci-ring.c | 32 +++- drivers/usb/image/mdc800.c | 4 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/storage/realtek_cr.c | 9 +- drivers/usb/typec/hd3ss3220.c | 9 +- drivers/usb/typec/mux.c | 21 ++- .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 28 ++- drivers/usb/typec/tipd/core.c | 17 +- drivers/usb/typec/tipd/tps6598x.h | 4 +- drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/watchdog/pseries-wdt.c | 53 +----- fs/ceph/crypto.c | 50 +++-- fs/ceph/mds_client.c | 12 +- fs/ceph/mds_client.h | 1 + fs/f2fs/data.c | 8 +- fs/f2fs/debug.c | 4 - fs/f2fs/dir.c | 7 +- fs/f2fs/f2fs.h | 29 ++- fs/f2fs/file.c | 170 +++++++++++++---- fs/f2fs/gc.c | 38 ++-- fs/f2fs/gc.h | 27 +-- fs/f2fs/inline.c | 2 +- fs/f2fs/iostat.c | 6 + fs/f2fs/namei.c | 17 +- fs/f2fs/node.c | 10 +- fs/f2fs/recovery.c | 41 +++-- fs/f2fs/segment.c | 18 +- fs/f2fs/super.c | 4 +- fs/f2fs/sysfs.c | 30 +-- fs/f2fs/xattr.c | 2 +- fs/nfsd/nfs4proc.c | 5 + fs/nfsd/nfs4state.c | 118 ++++++++---- fs/nfsd/nfsctl.c | 6 +- fs/ntfs3/frecord.c | 20 +- fs/smb/server/oplock.c | 79 ++++++-- include/linux/dma-buf.h | 1 + include/linux/ftrace.h | 5 +- include/linux/kprobes.h | 1 + include/linux/kvm_host.h | 1 + include/linux/pci.h | 8 +- include/linux/sched/rt.h | 2 + include/linux/sched/user.h | 3 +- include/linux/soc/qcom/geni-se.h | 4 + include/trace/events/f2fs.h | 20 +- kernel/bpf/percpu_freelist.c | 35 +++- kernel/bpf/percpu_freelist.h | 1 + kernel/bpf/stackmap.c | 173 ++++++++++++------ kernel/dma/direct.c | 18 +- kernel/events/core.c | 20 +- kernel/futex/pi.c | 16 +- kernel/futex/requeue.c | 12 +- kernel/kprobes.c | 14 +- kernel/locking/rtmutex_api.c | 2 + kernel/sched/core.c | 16 ++ kernel/trace/ftrace.c | 70 ++++--- kernel/trace/ring_buffer.c | 11 +- kernel/trace/trace.c | 67 ++++++- kernel/trace/trace.h | 5 +- kernel/trace/trace_btf.c | 12 +- kernel/trace/trace_events.c | 28 ++- kernel/trace/trace_functions.c | 2 +- kernel/trace/trace_stack.c | 2 +- lib/once.c | 2 +- mm/damon/core.c | 27 ++- mm/damon/ops-common.c | 5 +- mm/damon/paddr.c | 20 +- mm/damon/sysfs-schemes.c | 18 +- mm/damon/sysfs.c | 29 ++- mm/damon/tests/core-kunit.h | 33 +++- mm/damon/tests/vaddr-kunit.h | 5 + mm/damon/vaddr.c | 34 +--- mm/huge_memory.c | 2 + mm/hugetlb.c | 20 +- mm/hugetlb_cgroup.c | 7 +- mm/hugetlb_cma.c | 21 ++- mm/khugepaged.c | 6 - mm/madvise.c | 8 + mm/memcontrol-v1.c | 43 +++-- mm/memcontrol.c | 113 ++++++++++-- mm/mempolicy.c | 2 +- mm/migrate_device.c | 18 ++ mm/page_alloc.c | 6 +- mm/secretmem.c | 116 +++++++++++- mm/userfaultfd.c | 4 +- net/batman-adv/bridge_loop_avoidance.c | 15 +- net/batman-adv/distributed-arp-table.c | 8 +- net/batman-adv/main.c | 4 + net/batman-adv/mesh-interface.c | 7 +- net/batman-adv/multicast_forw.c | 7 +- net/core/skbuff.c | 5 +- net/sunrpc/xprtrdma/ib_client.c | 26 ++- rust/kernel/drm/ioctl.rs | 6 + samples/damon/mtier.c | 14 +- samples/damon/prcl.c | 11 +- samples/damon/wsse.c | 11 +- security/integrity/ima/ima_appraise.c | 2 + sound/core/pcm_native.c | 2 + sound/core/rawmidi.c | 2 +- sound/parisc/harmony.c | 6 +- sound/soc/codecs/adau1761.c | 34 ++-- sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/codecs/cx2072x.c | 134 +++++++------- sound/soc/codecs/hdac_hda.c | 4 +- sound/soc/codecs/max9860.c | 2 +- sound/soc/codecs/ml26124.c | 4 +- sound/soc/codecs/pcm512x.c | 40 ++-- sound/soc/codecs/pm4125-sdw.c | 2 +- sound/soc/codecs/rt1017-sdca-sdw.h | 10 +- sound/soc/codecs/rt1316-sdw.c | 2 +- sound/soc/codecs/rt1318-sdw.c | 2 +- sound/soc/codecs/rt1318.c | 4 +- sound/soc/codecs/rt274.c | 8 +- sound/soc/codecs/rt286.c | 14 +- sound/soc/codecs/rt298.c | 14 +- sound/soc/codecs/rt700-sdw.h | 11 +- sound/soc/codecs/rt711-sdca-sdw.h | 6 +- sound/soc/codecs/rt711-sdw.h | 10 +- sound/soc/codecs/rt712-sdca-dmic.h | 6 +- sound/soc/codecs/rt712-sdca-sdw.h | 11 +- sound/soc/codecs/rt715-sdca-sdw.h | 48 +++-- sound/soc/codecs/rt715-sdw.h | 32 ++-- sound/soc/codecs/rt721-sdca-sdw.h | 44 ++--- sound/soc/codecs/sgtl5000.c | 2 +- sound/soc/codecs/sti-sas.c | 2 +- sound/soc/codecs/tas2552.c | 14 +- sound/soc/codecs/tas2764.c | 2 +- sound/soc/codecs/tas2780.c | 2 +- sound/soc/codecs/tas2783-sdw.c | 177 +++++++++--------- sound/soc/fsl/fsl_easrc.c | 8 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/loongson/loongson_card.c | 6 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/usb/midi.c | 2 + tools/perf/Makefile.config | 2 + .../util/bpf_skel/augmented_raw_syscalls.bpf.c | 155 ++++++++++------ .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 ++--- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 ++ tools/testing/selftests/mm/memfd_secret.c | 30 +-- virt/kvm/guest_memfd.c | 4 + 461 files changed, 5681 insertions(+), 2746 deletions(-)

1 week, 3 days

Leads for Integrated Systems Europe Exhibitors

by Rachel Bailey

Hi team, I noticed your company was part of the Integrated Systems Europe (ISE) ecosystem. We help exhibitors connect with targeted decision-makers before, during, and after events. We provide verified B2B contact databases tailored for the professional AV, systems integration, digital signage, broadcast, smart building, unified communications, education technology, lighting, live events, and IT/networking sectors, helping companies improve outbound campaigns, generate qualified leads, and build partnerships. Verified B2B decision-maker database, including: AV & Systems Integration Professionals Digital Signage & DOOH Decision-Makers Broadcast & Content Production Professionals Smart Building & Workplace Technology Leaders Unified Communications & Collaboration Professionals IT & Networking Decision-Makers Live Events & Venue Professionals Retail, Hospitality & Corporate Technology Buyers Education Technology & Campus Technology Professionals, and more. Would this be of interest to you? If so, let me know your target audience and geography, and I'll share samples, available counts, and coverage details. Looking forward to hearing from you. Best Regards, Rachel Bailey | Sr. Demand Generation Reply “opt-out” to stop.

1 week, 4 days

[PATCH 7.2 000/713] 7.2.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.4 release. There are 713 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.4-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Do not combine resources that overlap completely Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Yuhang.chen <yhchen312(a)gmail.com> wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Breno Leitao <leitao(a)debian.org> mm/kmemleak: report RCU-tasks quiescent states during the scan Breno Leitao <leitao(a)debian.org> mm/kmemleak: stop the task stack scan early when interrupted Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - avoid stale fallback key after set_secret failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - clean up and improve ECDH comments Vinicius Costa Gomes <vinicius.gomes(a)intel.com> crypto: iaa - unmap dst before software fallback on decompress Xiang Mei <xmei5(a)asu.edu> fuse: copy request headers via a stack buffer for io-uring Joanne Koong <joannelkoong(a)gmail.com> fuse: decouple fuse_ring creation from ent registration Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Perform Dynamic Address Assignment on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Restore STDBR and EXTBR registers on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reset the controller on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Follow the reset deassert order used in probe Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Adrian Hunter <adrian.hunter(a)intel.com> i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Eliot Courtney <ecourtney(a)nvidia.com> rust: num: reject Bounded::shr overshifts at build time Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Ajrat Makhmutov <rauty(a)altlinux.org> ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: FCP: do not copy out an uninitialised init response Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Ali Ahmet Memis <ali(a)iusegentoo.com> mfd: qnap-mcu: keep the reply buffer alive past a command timeout Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Glenn Judd <gmj(a)meta.com> net/mlx5e: do not HW-GRO coalesce small frames Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: mctp: hold a reference to the route device in mctp_route_lookup() Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Joe Damato <joe(a)dama.to> net: bnxt: ring the doorbell when SW USO exits early Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Hui Su <sh_def(a)163.com> io_uring/waitid: avoid siginfo copy during ring teardown Hui Su <sh_def(a)163.com> io_uring/waitid: honor task_work cancellation Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Hilgad Montelo <hilgad.montelo(a)gmail.com> platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Abdun Nihaal <nihaal(a)cse.iitm.ac.in> platform/x86: int1092: Fix potential memory leak in sar_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate max level for set feature Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Shuai Xue <xueshuai(a)linux.alibaba.com> iommupt: Return zero for invalid iova_to_phys() ranges Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Robin Murphy <robin.murphy(a)arm.com> iommu/arm-smmu-v3: Add HAFT support for SVA Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ali Tariq <alitariq45892(a)gmail.com> PCI: starfive: Fix resource leaks on error paths in host_init() Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Karl Mehltretter <kmehltretter(a)gmail.com> s390/percpu: Fix MVIY_PERCPU() with older binutils Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Xu Rao <raoxu(a)uniontech.com> power: supply: pf1550: enable charging when battery profile exists Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Oscar Ou <oscarou(a)synology.com> lockd: fix swapped arguments in nlmsvc_match_ip() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Olga Kornievskaia <okorniev(a)redhat.com> lockd: fix NLMv4 GRANTED_MSG handling Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Alexander Graf <graf(a)amazon.com> dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> ASoC: codecs: aw88261: only check PLL and clock state at power-up Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Yuqi Xu <xuyuqiabc(a)gmail.com> openvswitch: Fix CT limit teardown use-after-free Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Matthias Goergens <matthias.goergens(a)gmail.com> ocfs2: fix cached cluster count after suballocator reclaim Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Doruk Tan Ozturk <doruk(a)0sec.ai> ocfs2: validate directory-index entry counts when reading metadata Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Ivan Immanuel Shaji <ivanimmanuel1234(a)gmail.com> ring-buffer: Stop remote reader update when page swap fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Yuhang Pan <242270054(a)hdu.edu.cn> RDMA/uverbs: Guard legacy bundles without method_elm Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Embed counter driver data in rdma_counter allocation Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Guidong Han <2045gemini(a)gmail.com> RISC-V: KVM: Fix PMU event info array size overflow Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Jianping Li <jianping.li(a)oss.qualcomm.com> arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Linkai Gong <gonglinkai(a)kylinos.cn> scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Tejun Heo <tj(a)kernel.org> sched_ext: Keep kick_sync waiting on the rq's own CPU Tejun Heo <tj(a)kernel.org> sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype Tao Cui <cuitao(a)kylinos.cn> sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users Tejun Heo <tj(a)kernel.org> sched_ext: Fix inverted ops.core_sched_before() invocation fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix exit_task leak on fork failure during enable fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection Tejun Heo <tj(a)kernel.org> sched_ext: Count rq lock releases in rq->scx.lock_drop_seq Tejun Heo <tj(a)kernel.org> sched_ext: Fix rq->core_pick corruption under core scheduling Tejun Heo <tj(a)kernel.org> sched_ext: Fix this_rq() assumptions in dispatch kfuncs Tejun Heo <tj(a)kernel.org> sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return Tejun Heo <tj(a)kernel.org> sched/core: Make core-sched flips wait for in-flight selections Tejun Heo <tj(a)kernel.org> sched/core: Handle pick_task() releasing the rq lock Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <cel(a)kernel.org> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <cel(a)kernel.org> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <cel(a)kernel.org> svcrdma: Reject Read lists that exceed the page budget Chuck Lever <cel(a)kernel.org> svcrdma: Reject oversized Read segments at decode time Chuck Lever <cel(a)kernel.org> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <cel(a)kernel.org> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Chuck Lever <cel(a)kernel.org> svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails Chuck Lever <cel(a)kernel.org> svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <cel(a)kernel.org> SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 Chuck Lever <cel(a)kernel.org> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Chris Mason <clm(a)meta.com> SUNRPC: fix gssx_dec_option_array error path bugs Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <cel(a)kernel.org> SUNRPC: close backchannel before destroying callback service Chuck Lever <cel(a)kernel.org> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Pratyush Yadav (Google) <pratyush(a)kernel.org> kho: fix size calculation in kho_preserved_memory_reserve() Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Dave Jiang <dave.jiang(a)intel.com> cxl/mce: Make the MCE notifier per-region Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Haoxiang Li <haoxiang_li2024(a)163.com> cpufreq: apple-soc: Fix OPP table cleanup Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Keith Busch <kbusch(a)kernel.org> block: validate user space vectors during extraction Junjie Cao <junjie.cao(a)linux.dev> backlight: aw99706: Honor the core blank state in update_status() Junjie Cao <junjie.cao(a)linux.dev> backlight: aw99706: Fix DT property names to match binding Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Add locking around AML evaluations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Avoid registering platform devices with resource overlaps Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Skip desired_perf read in cppc_get_perf() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Youngjae Kwon <yjkwon0026(a)snu.ac.kr> fsnotify: Fix stale object mask after concurrent mark updates Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Randy Dunlap <rdunlap(a)infradead.org> fonts: fixup font.h kernel-doc warnings Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Jan Kara <jack(a)suse.cz> ext2: Fix lost inode updates for IS_SYNC inodes Nikhil Gurudasani <nikhilgurudasani314(a)gmail.com> erofs: skip sufficiently large global buffers when resizing Jinjie Ruan <ruanjinjie(a)huawei.com> entry: Fix seccomp bypass after ptrace with TSYNC Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Hongling Zeng <zenghongling(a)kylinos.cn> ntfs: verify run length exceeding volume boundary Hongling Zeng <zenghongling(a)kylinos.cn> ntfs: validate non-resident attribute offsets Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: reject invalid MFT LCNs from boot sector Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: reject invalid empty mapping pairs Bryam Vargas <hexlabsecurity(a)proton.me> ntfs: bound the free-cluster bitmap scan to the volume Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: restore the data_offset bound in is_valid_oplock_break() Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: reject a tree connect response whose byte count is too small Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> ksmbd: only rebind the reopened file's own oplock on durable reconnect Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Jiangshan Yi <yijiangshan(a)kylinos.cn> smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Frank Sorenson <sorenson(a)redhat.com> cifs: call pagecache_isize_extended() in cifs_setsize() when extending Frank Sorenson <sorenson(a)redhat.com> cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: cap delegated inode count in ceph_parse_deleg_inos() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Max Kellermann <max.kellermann(a)ionos.com> ceph: force a cap message when a deferred revoke can't be acked immediately Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in check_new_map() on session freed during unlock Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Jeff Layton <jlayton(a)kernel.org> nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during delegation revoke Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during admin state revocation Chuck Lever <cel(a)kernel.org> NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Chuck Lever <cel(a)kernel.org> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: release OPEN-decoded posix ACLs via op_release Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <cel(a)kernel.org> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix UAF in async copy cancel and shutdown Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure NeilBrown <neil(a)brown.name> nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() Chris Mason <clm(a)meta.com> nfsd: fix partial-write detection in nfsd_direct_write Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix layout fence worker double-reference race Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix clock domain mismatch in clients_still_reclaiming() Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke NeilBrown <neil(a)brown.name> nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: dedup nfs4_client_to_reclaim inserts Chris Mason <clm(a)meta.com> nfsd: convert nfsd_net boolean flags to unsigned long flags word Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Chris Mason <clm(a)meta.com> nfsd: cap decoded POSIX ACL count to bound sort cost Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <cel(a)kernel.org> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Jeff Layton <jlayton(a)kernel.org> nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths Chuck Lever <cel(a)kernel.org> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Jeff Layton <jlayton(a)kernel.org> lockd, nfsd: RCU-protect nlmsvc_ops dispatch Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Scott Mayhew <smayhew(a)redhat.com> NFSD: fix up error returned by write_threads() Chuck Lever <cel(a)kernel.org> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <cel(a)kernel.org> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <cel(a)kernel.org> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: set default primary compressor in zram_destroy_comps() Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in writeback_store() Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in read_block_state() Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Karl Mehltretter <kmehltretter(a)gmail.com> KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Fix out-of-bounds access for newdevs mask Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Xu Rao <raoxu(a)uniontech.com> usb: typec: hd3ss3220: fix VBUS regulator error message Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Chun-Yi Lee <jlee(a)suse.com> debugfs: Fix lockdown check for mmap_prepare Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Ivan Immanuel Shaji <ivanimmanuel1234(a)gmail.com> tracing: Fix retry exhaustion in simple ring buffer reader swap Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Roger Pau Monne <roger(a)xenproject.org> x86/xen: fix init of balloon stats again Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Artem Lytkin <iprintercanon(a)gmail.com> mm/vmalloc: make vm_struct.nr_pages an unsigned long Shengming Hu <hu.shengming(a)zte.com.cn> mm/slub: prevent pfmemalloc objects from entering the barn Li Xiasong <lixiasong1(a)huawei.com> mm/slub: fix missing debugfs entries for caches created before sysfs init Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_migrate_one() Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Arvind Yadav <arvind.yadav(a)intel.com> mm/migrate_device: clear stale mapping after freeing swapcache Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Kairui Song <kasong(a)tencent.com> mm/mglru: fix and remove redundant unevictable folio handling Usama Arif <usama.arif(a)linux.dev> mm/mempolicy: skip non-present PMDs when queueing folios Usama Arif <usama.arif(a)linux.dev> mm/madvise: skip device-private PMDs in cold and pageout walks Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Zi Yan <ziy(a)nvidia.com> mm/huge_memory: use folio's memcg inside __folio_split() Usama Arif <usama.arif(a)linux.dev> mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Youngjun Park <youngjun.park(a)lge.com> mm, swap: don't free a hibernation slot that is in the swap cache Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: keep Rust objects out of Clang LTO with inline helpers Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: preserve unreachable traps with inline helpers Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Younes Akhouayri <git(a)younes.io> rust: num: restrict bool conversion to unsigned Bounded Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment Miguel Ojeda <ojeda(a)kernel.org> rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` Danilo Krummrich <dakr(a)kernel.org> rust: devres: ensure revocation is complete before device finishes unbinding Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race between concurrent revokers Younes Akhouayri <git(a)younes.io> rust: dma: return zero for Coherent reads past EOF Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: prevent dead_code warning from warn_on!'s flags constant FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Antoni Boucher <bouanto(a)zoho.com> rust: kbuild: disambiguate `zerocopy` for `rusttest` Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Ke Sun <sunke(a)kylinos.cn> rust: fmt: fix {:p} printing stack addresses Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Chen Linxuan <me(a)black-desk.cn> pidfd: hold exec_update_lock around namespace ioctl Vivek Parikh <vivek.parikh(a)breachx.ai> ovl: fix double end_creating() on the casefold-mismatch path Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Christoph Hellwig <hch(a)lst.de> iomap: don't free integrity payload that doesn't exist Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Boris Burkov <boris(a)bur.io> btrfs: write-protect folios during data writeback Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort MBDRC register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort ADMAIF register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the MIXER enable default value Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the I2S enable default value Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_mixer: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the Tegra264 register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the register default table Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Skip Update HDCP Config In Transition State ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 17 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/kodiak.dtsi | 9 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 - .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/arm64/kvm/vgic/vgic-v2.c | 3 +- arch/openrisc/kernel/entry.S | 43 ++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts | 4 +- arch/riscv/include/asm/acpi.h | 19 + arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/riscv/kvm/vcpu_pmu.c | 14 +- arch/s390/include/asm/percpu.h | 4 +- arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++---- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 ++ arch/x86/kvm/emulate.c | 26 +- arch/x86/net/bpf_jit_comp.c | 2 +- block/bio.c | 56 ++- block/blk-map.c | 2 +- block/fops.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 +- drivers/acpi/acpi_platform.c | 45 ++- drivers/acpi/acpi_tad.c | 46 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 ++- drivers/acpi/cppc_acpi.c | 24 +- drivers/acpi/pfr_update.c | 45 +-- drivers/ata/libata-scsi.c | 28 +- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/block/zram/zram_drv.c | 14 +- drivers/bluetooth/btrtl.c | 13 - drivers/bluetooth/btusb.c | 14 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/cpufreq/apple-soc-cpufreq.c | 36 +- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/crypto/atmel-ecc.c | 46 +-- drivers/crypto/intel/iaa/iaa_crypto_main.c | 27 +- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/mbox.c | 8 - drivers/cxl/core/mce.c | 27 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/core/ras_rch.c | 27 +- drivers/cxl/core/region.c | 43 +-- drivers/cxl/cxl.h | 11 +- drivers/cxl/cxlmem.h | 2 - drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 79 ++++ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 28 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 + drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 + drivers/hid/hid-mcp2221.c | 17 +- drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/device.c | 2 +- drivers/i3c/internals.h | 5 + drivers/i3c/master.c | 18 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 142 +++++--- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ib_core_uverbs.c | 3 + drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_main.c | 1 + drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_hw_stats.c | 95 +++-- drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 +- drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 24 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 65 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/generic_pt/iommu_pt.h | 2 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 +- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +- drivers/md/dm-io.c | 96 +++-- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 + drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 +- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 +- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/qnap-mcu.c | 13 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +- drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c | 4 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 ++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/net/wireless/realtek/rtw89/core.h | 1 + drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +- drivers/net/wireless/realtek/rtw89/pci.c | 13 + drivers/net/wireless/realtek/rtw89/pci.h | 1 + drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922de.c | 1 + drivers/ntb/ntb_transport.c | 38 +- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++- drivers/pci/controller/plda/pcie-starfive.c | 13 +- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 ++- drivers/pci/pcie/aer.c | 29 +- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 66 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/platform/x86/intel/int1092/intel_sar.c | 32 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 80 ++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/platform/x86/panasonic-laptop.c | 11 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 ++- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 +- drivers/power/supply/pf1550-charger.c | 2 +- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 ++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/fnic/fip.c | 2 +- drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 +-- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/hd3ss3220.c | 2 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- drivers/video/backlight/aw99706.c | 10 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + drivers/xen/balloon.c | 29 +- fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/extent_io.c | 31 ++ fs/btrfs/extent_io.h | 5 + fs/btrfs/inode.c | 23 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 +- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 74 +++- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 +- fs/ceph/mds_client.c | 73 +++- fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 11 +- fs/ceph/super.h | 14 + fs/ceph/xattr.c | 1 + fs/debugfs/file.c | 3 +- fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 +- fs/erofs/zutil.c | 2 + fs/ext2/inode.c | 7 +- fs/ext2/xattr.c | 4 +- fs/fat/misc.c | 4 + fs/fuse/dev.c | 8 +- fs/fuse/dev.h | 2 +- fs/fuse/dev_uring.c | 38 +- fs/fuse/dev_uring_i.h | 5 + fs/fuse/inode.c | 4 +- fs/iomap/bio.c | 2 +- fs/iomap/direct-io.c | 1 + fs/jbd2/checkpoint.c | 28 +- fs/lockd/clntproc.c | 3 + fs/lockd/lockd.h | 2 +- fs/lockd/svc.c | 4 +- fs/lockd/svc4proc.c | 7 +- fs/lockd/svcproc.c | 4 +- fs/lockd/svcsubs.c | 107 ++++-- fs/nfs/callback.c | 4 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 143 ++++---- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/lockd.c | 6 +- fs/nfsd/netns.h | 35 +- fs/nfsd/nfs2acl.c | 52 +-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 +++ fs/nfsd/nfs4callback.c | 113 +++++- fs/nfsd/nfs4layouts.c | 39 +- fs/nfsd/nfs4proc.c | 225 ++++++++---- fs/nfsd/nfs4recover.c | 48 ++- fs/nfsd/nfs4state.c | 399 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 40 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 156 ++++++-- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 49 ++- fs/nfsd/nfsxdr.c | 32 +- fs/nfsd/state.h | 4 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 39 +- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 17 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ntfs/attrib.c | 24 +- fs/ntfs/lcnalloc.c | 7 +- fs/ntfs/runlist.c | 48 +++ fs/ntfs/super.c | 12 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++ fs/ocfs2/cluster/heartbeat.c | 150 ++++++-- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 47 ++- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 ++- fs/ocfs2/suballoc.c | 2 +- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/overlayfs/dir.c | 1 - fs/pidfs.c | 43 ++- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/cifsfs.h | 1 + fs/smb/client/cifssmb.c | 6 + fs/smb/client/dfs_cache.c | 33 +- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 56 ++- fs/smb/client/smb1misc.c | 3 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb1transport.c | 35 +- fs/smb/client/smb2file.c | 5 +- fs/smb/client/smb2inode.c | 6 +- fs/smb/client/smb2ops.c | 9 +- fs/smb/client/trace.h | 3 +- fs/smb/server/vfs_cache.c | 2 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/bio.h | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/entry-common.h | 3 + include/linux/font.h | 4 +- include/linux/hugetlb.h | 7 + include/linux/list.h | 15 +- include/linux/lockd/bind.h | 12 +- include/linux/sunrpc/bc_xprt.h | 5 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/uio.h | 10 +- include/linux/usb/tcpci.h | 1 + include/linux/vmalloc.h | 2 +- include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + io_uring/waitid.c | 33 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/dma/contiguous.c | 16 +- kernel/liveupdate/kexec_handover.c | 2 +- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 -- kernel/reboot.c | 29 ++ kernel/sched/core.c | 49 ++- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/sched/ext/ext.c | 342 +++++++++++++----- kernel/sched/sched.h | 5 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 202 +++++++---- kernel/trace/simple_ring_buffer.c | 4 +- kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/iov_iter.c | 9 +- lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++--- mm/gup.c | 10 +- mm/huge_memory.c | 24 +- mm/hugetlb.c | 38 +- mm/hugetlb_vmemmap.c | 23 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 77 ++-- mm/madvise.c | 4 +- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 + mm/mempolicy.c | 29 +- mm/migrate.c | 8 +- mm/migrate_device.c | 13 + mm/mm_init.c | 10 +- mm/page_alloc.c | 76 +++- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/pagewalk.c | 6 +- mm/rmap.c | 31 +- mm/slub.c | 80 +++-- mm/sparse-vmemmap.c | 4 +- mm/swapfile.c | 15 +- mm/vmalloc.c | 58 ++- mm/vmscan.c | 40 +-- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 ++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mctp/route.c | 19 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 128 ++++--- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 60 ++-- net/openvswitch/datapath.h | 8 +- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +- net/smc/smc_llc.c | 122 +++++-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_unseal.c | 3 + net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 15 +- net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/backchannel_rqst.c | 38 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 ++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 21 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 52 ++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++- net/sunrpc/xprtrdma/svc_rdma_transport.c | 69 +++- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/Makefile | 6 +- rust/kernel/bug.rs | 34 +- rust/kernel/devres.rs | 25 +- rust/kernel/dma.rs | 6 +- rust/kernel/fmt.rs | 9 +- rust/kernel/list.rs | 2 +- rust/kernel/num/bounded.rs | 31 +- rust/kernel/time.rs | 17 +- scripts/Makefile.build | 3 +- scripts/rust_is_available.sh | 14 + scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 +- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 ++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 ++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/codecs/realtek/alc662.c | 1 + sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/aw88261.c | 6 +- sound/soc/codecs/aw88261.h | 6 - sound/soc/tegra/tegra210_admaif.c | 210 +++++++---- sound/soc/tegra/tegra210_i2s.c | 24 +- sound/soc/tegra/tegra210_i2s.h | 1 + sound/soc/tegra/tegra210_mbdrc.c | 42 +-- sound/soc/tegra/tegra210_mixer.c | 10 +- sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- sound/usb/fcp.c | 4 +- tools/include/linux/compiler.h | 2 +- tools/objtool/check.c | 2 + tools/sched_ext/include/scx/compat.bpf.h | 12 +- tools/sched_ext/include/scx/enum_defs.autogen.h | 1 - tools/sched_ext/include/scx/enums.autogen.bpf.h | 3 - tools/sched_ext/include/scx/enums.autogen.h | 1 - tools/sched_ext/scx_qmap.bpf.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 621 files changed, 7838 insertions(+), 3129 deletions(-)

2 weeks

[PATCH 6.18 000/551] 6.18.50-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 07 Sep 2026 11:55:07 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.50-rc2 Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: avoid unnecessary use of is_swap_pmd() Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Refactor amdgpu_dm_connector_detect (v2) Roman Li <Roman.Li(a)amd.com> drm/amd/display: Skip PHY SSC reduction on some 8K panels David Howells <dhowells(a)redhat.com> netfs: Fix missing locking around retry adding new subreqs Rong Zhang <i(a)rong.moe> platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Christian Brauner <brauner(a)kernel.org> nsfs: tighten permission checks for handle opening Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Eric Dumazet <edumazet(a)google.com> ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/include/asm/acpi.h | 19 ++ arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/s390/kernel/perf_cpum_cf.c | 221 +++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 +++ arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 +++-- drivers/acpi/pfr_update.c | 45 ++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/bluetooth/btrtl.c | 13 -- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ----- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/cxl.h | 3 +- drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 114 ++++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 ++ drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++-- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 70 +++++- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++-- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 ++- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +-- drivers/md/dm-io.c | 96 ++++---- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 ++ drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 ++- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 ++- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 ++-- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 ++- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 +++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/aer.c | 29 ++- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 43 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/wmi-helpers.c | 4 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 ++- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/fat/misc.c | 4 + fs/fuse/dev.c | 3 +- fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 +++-- fs/netfs/read_retry.c | 6 +- fs/netfs/write_retry.c | 6 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 22 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/nfs2acl.c | 52 +++-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4callback.c | 113 +++++++-- fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 62 +++-- fs/nfsd/nfs4state.c | 253 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 26 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 129 ++++++++--- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/state.h | 3 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 34 +-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 5 +- fs/nsfs.c | 2 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 +++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 1 + fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 2 + include/linux/netdevice.h | 3 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 39 +++- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/bpf/verifier.c | 27 ++- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 --- kernel/reboot.c | 29 +++ kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 177 ++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++++---- mm/gup.c | 10 +- mm/huge_memory.c | 4 +- mm/hugetlb.c | 8 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 ++ mm/memory.c | 49 ++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/mm_init.c | 9 +- mm/page_alloc.c | 76 ++++++- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/pagewalk.c | 6 +- mm/rmap.c | 20 +- mm/swapfile.c | 6 +- mm/vmscan.c | 21 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +-- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++-- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++-- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +-- net/smc/smc_llc.c | 122 +++++++--- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 +++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/kernel/bug.rs | 8 +- rust/kernel/list.rs | 2 +- rust/kernel/time.rs | 17 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 +++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 504 files changed, 5464 insertions(+), 2549 deletions(-)

2 weeks, 1 day

[PATCH 6.12 000/400] 6.12.109-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 07 Sep 2026 11:55:05 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.109-rc2 Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: avoid unnecessary use of is_swap_pmd() Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ashish Kalra <ashish.kalra(a)amd.com> x86/sev: Fix broken SNP support with KVM module built-in Gao Shiyuan <gaoshiyuan(a)baidu.com> iommu/amd: remove return value of amd_iommu_detect Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 Ming Lei <tom.leiming(a)gmail.com> block: mark GFP_NOIO around sysfs ->store() Chao Yu <chao(a)kernel.org> f2fs: fix potential deadloop in prepare_compress_overwrite() Yang Erkun <yangerkun(a)huawei.com> md: make rdev_addable usable for rcu mode Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Mask the bd_cnt field in the TX BD properly ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 4 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 3 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/huge_memory.c | 4 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/memory.c | 49 +++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/rmap.c | 60 ++++-- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 371 files changed, 3772 insertions(+), 1885 deletions(-)

2 weeks, 1 day

[PATCH 6.18 000/552] 6.18.50-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.50 release. There are 552 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.50-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Refactor amdgpu_dm_connector_detect (v2) Roman Li <Roman.Li(a)amd.com> drm/amd/display: Skip PHY SSC reduction on some 8K panels David Howells <dhowells(a)redhat.com> netfs: Fix missing locking around retry adding new subreqs Rong Zhang <i(a)rong.moe> platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Christian Brauner <brauner(a)kernel.org> nsfs: tighten permission checks for handle opening Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Eric Dumazet <edumazet(a)google.com> ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/include/asm/acpi.h | 19 ++ arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/s390/kernel/perf_cpum_cf.c | 221 +++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 +++ arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 +++-- drivers/acpi/pfr_update.c | 45 ++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/bluetooth/btrtl.c | 13 -- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ----- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/cxl.h | 3 +- drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 114 ++++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 ++ drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++-- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 70 +++++- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++-- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 ++- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +-- drivers/md/dm-io.c | 96 ++++---- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 ++ drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 ++- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 ++- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 ++-- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 ++- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 +++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/aer.c | 29 ++- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 43 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/wmi-helpers.c | 4 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 ++- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/fat/misc.c | 4 + fs/fuse/dev.c | 3 +- fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 +++-- fs/netfs/read_retry.c | 6 +- fs/netfs/write_retry.c | 6 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 22 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/nfs2acl.c | 52 +++-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4callback.c | 113 +++++++-- fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 62 +++-- fs/nfsd/nfs4state.c | 253 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 26 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 129 ++++++++--- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/state.h | 3 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 34 +-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 5 +- fs/nsfs.c | 2 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 +++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 1 + fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/list.h | 15 +- include/linux/netdevice.h | 3 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 39 +++- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/bpf/verifier.c | 27 ++- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 --- kernel/reboot.c | 29 +++ kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 177 ++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++++---- mm/gup.c | 10 +- mm/hugetlb.c | 8 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 ++ mm/mempolicy.c | 21 +- mm/migrate.c | 8 +- mm/mm_init.c | 9 +- mm/page_alloc.c | 76 ++++++- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/pagewalk.c | 6 +- mm/swapfile.c | 6 +- mm/vmscan.c | 21 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +-- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++-- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++-- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +-- net/smc/smc_llc.c | 122 +++++++--- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 +++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/kernel/bug.rs | 8 +- rust/kernel/list.rs | 2 +- rust/kernel/time.rs | 17 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 +++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 498 files changed, 5399 insertions(+), 2514 deletions(-)

2 weeks, 1 day

[PATCH 6.12 000/403] 6.12.109-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.109 release. There are 403 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.109-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ashish Kalra <ashish.kalra(a)amd.com> x86/sev: Fix broken SNP support with KVM module built-in Gao Shiyuan <gaoshiyuan(a)baidu.com> iommu/amd: remove return value of amd_iommu_detect Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 Ming Lei <tom.leiming(a)gmail.com> block: mark GFP_NOIO around sysfs ->store() Chao Yu <chao(a)kernel.org> f2fs: fix potential deadloop in prepare_compress_overwrite() Yang Erkun <yangerkun(a)huawei.com> md: make rdev_addable usable for rcu mode Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Mask the bd_cnt field in the TX BD properly ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/list.h | 15 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/mempolicy.c | 21 +- mm/migrate.c | 8 +- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 366 files changed, 3709 insertions(+), 1854 deletions(-)

2 weeks, 2 days

[PATCH 7.2 00/71] 7.2.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.3 release. There are 71 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.3-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Trevor Vorhees <vorhees-work(a)proton.me> ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Eric Dumazet <edumazet(a)google.com> vlan: fix skb_under_panic and races when toggling HW VLAN offload Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Sean Christopherson <seanjc(a)google.com> KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Joanne Koong <joannelkoong(a)gmail.com> fuse: publish io-uring queues with release semantics Joanne Koong <joannelkoong(a)gmail.com> fuse: fix missing barrier when checking io-uring readiness Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix race between interrupt and resend Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jiayuan Chen <jiayuan.chen(a)linux.dev> selftests/bpf: Fix test_maps sockmap failure Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/svm/sev.c | 99 ++++++++---- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 63 -------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 ---- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 45 ------ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 --------------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 111 +++++++------ drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 ++ drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +------ drivers/crypto/qce/common.c | 55 ++----- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +--- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +---------- drivers/crypto/qcom-rng.c | 156 +++--------------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 18 ++- drivers/net/gtp.c | 21 ++- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 ++- drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 ++- drivers/usb/serial/spcp8x5.c | 13 -- fs/fuse/dev.c | 41 ++--- fs/fuse/dev_uring.c | 20 +-- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/skbuff.h | 24 +++ include/net/ip.h | 25 +++ include/net/ip6_route.h | 37 +++++ include/net/tcp.h | 5 + include/target/target_core_fabric.h | 2 + mm/swapfile.c | 7 + net/8021q/vlan_dev.c | 39 +---- net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ao.c | 19 ++- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/ah6.c | 29 ++-- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 7 + net/ipv6/tcp_ipv6.c | 2 +- net/netfilter/nf_tables_api.c | 36 +++-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/packet/af_packet.c | 96 +++++++++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++-- net/xfrm/xfrm_user.c | 2 +- sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + sound/usb/quirks-table.h | 10 ++ .../selftests/bpf/progs/sockmap_verdict_prog.c | 14 +- 83 files changed, 748 insertions(+), 1182 deletions(-)

2 weeks, 5 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage September 2026