Lkft-triage September 2026

lkft-triage@lists.linaro.org

29 participants
36 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.51 release. There are 583 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Sep 2026 13:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.51-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.51-rc1 Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback Christian Brauner <brauner(a)kernel.org> pidfs: protect PIDFD_GET_* ioctls() via ifdef Zi Yan <ziy(a)nvidia.com> mm/huge_memory: use folio's memcg inside __folio_split() Matthew Wilcox (Oracle) <willy(a)infradead.org> migrate: replace RMP_ flags with TTU_ flags Zi Yan <ziy(a)nvidia.com> mm/huge_memory: replace can_split_folio() with direct refcount calculation Zi Yan <ziy(a)nvidia.com> mm/huge_memory: change folio_split_supported() to folio_check_splittable() Muchun Song <muchun.song(a)linux.dev> mm: thp: use folio_batch to handle THP splitting in deferred_split_scan() Muchun Song <muchun.song(a)linux.dev> mm: thp: introduce folio_split_queue_lock and its variants SJ Park <sj(a)kernel.org> mm/damon/core: initialize damos->last_applied SJ Park <sj(a)kernel.org> mm/damon/core-kunit: handle region split failure in filter_out() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() SJ Park <sj(a)kernel.org> mm/damon/core: skip aging from repeated aggressive merging SJ Park <sj(a)kernel.org> mm/damon/ops-common: use nr_accesses moving sum for quota score SJ Park <sj(a)kernel.org> mm/damon/paddr: drop last same folio access check reuse optimization SJ Park <sj(a)kernel.org> mm/damon/vaddr: drop last same folio access check optimization SJ Park <sj(a)kernel.org> mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() Robin Murphy <robin.murphy(a)arm.com> iommu/arm-smmu-v3: Add HAFT support for SVA Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ab8500_fg: fix use-after-free on remove Pan Chuang <panchuang(a)vivo.com> power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() Song Hu <husong(a)kylinos.cn> Docs/ABI/damon: fix typo in intervals_goal sysfs path Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Kiryl Shutsemau <kas(a)kernel.org> hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU Kiryl Shutsemau <kas(a)kernel.org> mm: rework compound_head() for power-of-2 sizeof(struct page) Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: set default primary compressor in zram_destroy_comps() Yuwen Chen <ywen.chen(a)foxmail.com> zram: fix the issue that the write - back limits might overflow Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: read slot block idx under slot lock Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: drop wb_limit_lock Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: take write lock in wb limit store handlers Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in read_block_state() Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: fixup read_block_state() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during close_lru reaping Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during blocked-lock reaping Chuck Lever <chuck.lever(a)oracle.com> NFSD: Consolidate the revocation-path client unpin Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: reject a tree connect response whose byte count is too small David Howells <dhowells(a)redhat.com> cifs: Do some preparation prior to organising the function declarations Frank Sorenson <sorenson(a)redhat.com> smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 David Howells <dhowells(a)redhat.com> cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h David Howells <dhowells(a)redhat.com> cifs: SMB1 split: Create smb1proto.h for SMB1 declarations David Howells <dhowells(a)redhat.com> cifs: Remove dead function prototypes Jiangshan Yi <yijiangshan(a)kylinos.cn> smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/smb2proto.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/fs_context.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/fscache.h David Howells <dhowells(a)redhat.com> cifs: Scripted clean up fs/smb/client/cifs_unicode.h Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during admin state revocation Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: convert global state_lock to per-net deleg_lock Jeff Layton <jlayton(a)kernel.org> nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Jeff Layton <jlayton(a)kernel.org> nfsd: fix UAF in async copy cancel and shutdown Jeff Layton <jlayton(a)kernel.org> nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Jeff Layton <jlayton(a)kernel.org> nfsd: fix clock domain mismatch in clients_still_reclaiming() Jeff Layton <jlayton(a)kernel.org> nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Jeff Layton <jlayton(a)kernel.org> nfsd: move struct nfsd_genl_rqstp to nfsctl.c Jeff Layton <jlayton(a)kernel.org> nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Eric Dumazet <edumazet(a)google.com> ipv4: use dst4_mtu() instead of dst_mtu() Eric Dumazet <edumazet(a)google.com> ipv6: use dst6_mtu() instead of dst_mtu() Eric Dumazet <edumazet(a)google.com> inet: add dst4_mtu() and dst6_mtu() helpers Eric Dumazet <edumazet(a)google.com> ipv6: add some unlikely()/likely() clauses in ip6_output.c Eric Dumazet <edumazet(a)google.com> ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts() Xiang Mei <xmei5(a)asu.edu> fuse: copy request headers via a stack buffer for io-uring Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: use named constants for io-uring iovec indices Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor setting up copy state for payload copying Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: use enum types for header copying Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor io-uring header copying from ring Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: refactor io-uring header copying to ring Joanne Koong <joannelkoong(a)gmail.com> fuse: fix missing barrier when checking io-uring readiness Ali Tariq <alitariq45892(a)gmail.com> PCI: starfive: Fix resource leaks on error paths in host_init() Hal Feng <hal.feng(a)starfivetech.com> PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots Oscar Ou <oscarou(a)synology.com> lockd: fix swapped arguments in nlmsvc_match_ip() Doruk Tan Ozturk <doruk(a)0sec.ai> ocfs2: validate directory-index entry counts when reading metadata Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: validate dx_root extent list fields during block read Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> ASoC: codecs: aw88261: only check PLL and clock state at power-up Val Packett <val(a)packett.cool> ASoC: codecs: aw88261: reduce log spam Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> firmware: qcom_scm: Rename peripheral as pas_id Tejun Heo <tj(a)kernel.org> sched/core: Make core-sched flips wait for in-flight selections John Stultz <jstultz(a)google.com> sched: Rework prev_balance() to avoid stale prev references John Stultz <jstultz(a)google.com> sched: Add assert_balance_callbacks_empty helper Tejun Heo <tj(a)kernel.org> sched_ext: Fix inverted ops.core_sched_before() invocation Linkai Gong <gonglinkai(a)kylinos.cn> scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Embed counter driver data in rdma_counter allocation fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix exit_task leak on fork failure during enable Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject Read lists that exceed the page budget Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject oversized Read segments at decode time Chuck Lever <chuck.lever(a)oracle.com> rpcrdma: arm rn_done before publishing the notification Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Release transport resources synchronously Chris Mason <clm(a)meta.com> SUNRPC: fix gssx_dec_option_array error path bugs Dave Jiang <dave.jiang(a)intel.com> cxl/mce: Make the MCE notifier per-region Smita Koralahalli <Smita.KoralahalliChannabasappa(a)amd.com> cxl/region: Add helper to check Soft Reserved containment by CXL regions Dan Williams <dan.j.williams(a)intel.com> dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Jiri Olsa <jolsa(a)kernel.org> bpf: Disable preemption in bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Use stack id functions instead of __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_new_bucket from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_fastpath function from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_init function from __bpf_get_stackid Haoxiang Li <haoxiang_li2024(a)163.com> cpufreq: apple-soc: Fix OPP table cleanup Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Add locking around AML evaluations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Rearrange RT data validation checking Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: x86/rtc-cmos: Use platform device for driver binding Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: x86: cmos_rtc: Create a CMOS RTC platform device Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ Nikhil Gurudasani <nikhilgurudasani314(a)gmail.com> erofs: skip sufficiently large global buffers when resizing Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Florian Pradines <florian.pradines(a)gmail.com> HID: mcp2221: fix OOB write in mcp2221_raw_event() Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: clean up device list on probe failure Rosalie Wanders <rosalie(a)mailbox.org> HID: sony: use guard() and scoped_guard() Frank Sorenson <sorenson(a)redhat.com> cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Huiwen He <hehuiwen(a)kylinos.cn> smb/client: emulate small EOF-extending mode 0 fallocate ranges Huiwen He <hehuiwen(a)kylinos.cn> smb/client: reduce fallocate zero buffer allocation ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move some definitions from common/smb2pdu.h into common/fscc.h Sam Edwards <cfsworks(a)gmail.com> ceph: properly decrypt filenames in vmalloc() buffers Chuck Lever <chuck.lever(a)oracle.com> NFSD: Guard admin state-revocation walks with NFSD_NET_UP Max Kellermann <max.kellermann(a)ionos.com> ceph: force a cap message when a deferred revoke can't be acked immediately Michael Bommarito <michael.bommarito(a)gmail.com> ceph: cap delegated inode count in ceph_parse_deleg_inos() Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Terry Bowman <terry.bowman(a)amd.com> cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Fix Use-After-Free in AIO error path Gabriel Prostitis <prostitisgabriel(a)gmail.com> USB: gadget: ffs: fix mm lifetime handling Brendan Jackman <jackmanb(a)google.com> mm/page_alloc: don't spin_trylock() in NMI on UP Roger Pau Monne <roger(a)xenproject.org> x86/xen: fix init of balloon stats again Roger Pau Monne <roger.pau(a)citrix.com> xen/balloon: improve accuracy of initial balloon target for dom0 Li Xiasong <lixiasong1(a)huawei.com> mm/slub: fix missing debugfs entries for caches created before sysfs init Vlastimil Babka <vbabka(a)suse.cz> mm/slab: move and refactor __kmem_cache_alias() Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_migrate_one() Kairui Song <kasong(a)tencent.com> mm/mglru: fix and remove redundant unevictable folio handling Kairui Song <kasong(a)tencent.com> mm/mglru: use the common routine for dirty/writeback reactivation Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Kiryl Shutsemau <kas(a)kernel.org> mm/hugetlb: refactor code around vmemmap_walk Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: defer vmemmap population for bootmem hugepages FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: prevent dead_code warning from warn_on!'s flags constant Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race between concurrent revokers Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race condition due to nesting Chen Linxuan <me(a)black-desk.cn> pidfd: hold exec_update_lock around namespace ioctl Christian Brauner <brauner(a)kernel.org> pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls Vivek Parikh <vivek.parikh(a)breachx.ai> ovl: fix double end_creating() on the casefold-mismatch path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - avoid stale fallback key after set_secret failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - clean up and improve ECDH comments Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - replace min_t with min Vinicius Costa Gomes <vinicius.gomes(a)intel.com> crypto: iaa - unmap dst before software fallback on decompress Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Eric Dumazet <edumazet(a)google.com> vlan: fix skb_under_panic and races when toggling HW VLAN offload Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix race between interrupt and resend Miklos Szeredi <mszeredi(a)redhat.com> fuse: remove fm arg of args->end callback Miklos Szeredi <mszeredi(a)redhat.com> fuse: split off fuse_args and related definitions into a separate header Joanne Koong <joannelkoong(a)gmail.com> fuse: publish io-uring queues with release semantics Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: simplify handling of Structural Parameters 1 values Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: use cached HCSPARAMS1 value Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: implement USB Port Register Set struct Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add USB Port Register Set struct Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add helper to read PORTSC register Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: add tracing for PORTSC register writes David Howells <dhowells(a)redhat.com> afs: Fix leak of ungot volume Abdifatah Suruur <suruurism(a)gmail.com> ksmbd: fix use-after-free in oplock break notification Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: fix vblank interrupts on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix head state readback on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI vendor infoframes on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Faith Ekstrand <faith.ekstrand(a)collabora.com> drm/nouveau: Use write-combined maps for coherent Marek Czernohous <marek(a)czernohous.de> drm/nouveau: unsubscribe the channel-kill event before the fence context Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve stride validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve panel-size validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve framebuffer-size validation Sunday Clement <Sunday.Clement(a)amd.com> drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix error path at svm_migrate_copy_to_ram Priya Hosur <Priya.Hosur(a)amd.com> drm/amdkfd: Add TLB flush after MES queue eviction/suspension Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx12 userqueues Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx11 userqueues Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Skip accessing psp rum time db for APUs Guangshuo Li <lgs201920130244(a)gmail.com> drm/amdgpu: fix autosuspend cleanup during removal Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: Disable runtime PM for externally attached dGPUs Xiang Liu <xiang.liu(a)amd.com> drm/amdgpu: clamp the isolation index for rings outside a partition Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check thunderbolt before switcheroo registration Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Kavan Smith <kavansmith82(a)gmail.com> drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Tao Yu <tao1.yu(a)intel.com> drm/gud: validate TV mode names before creating enum property Deepanshu Kartikey <kartikey406(a)gmail.com> drm/gud: NUL-terminate TV mode names read from the device David (Ming Qiang) Wu <David.Wu3(a)amd.com> drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: validate plane degamma LUT size for private color prop Linkai Gong <gonglinkai(a)kylinos.cn> drm/amd/display: fix dc_lock leak on GPU reset error paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Use drm_atomic_helper_check_plane_state() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Fix list of formats on the primary plane Lyude Paul <lyude(a)redhat.com> drm/nouveau/disp/r535: Add scanline position support + head state support Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates in ssd133x Wentao Liang <vulab(a)iscas.ac.cn> drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates for ssd132x Deepanshu Kartikey <kartikey406(a)gmail.com> drm/i915: Guard against NULL driver_data in i915_pci_probe() Danilo Krummrich <dakr(a)kernel.org> drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold <johan(a)kernel.org> drm/panel-edp: fix i2c adapter leak on probe failure Johan Hovold <johan(a)kernel.org> drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: fix firmware control interface bounds checks Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: harden firmware build-info bounds checks Matthew Auld <matthew.auld(a)intel.com> drm/xe/vram: report FLAT_CCS base misalignment Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Chao Yu <chao(a)kernel.org> f2fs: fix to zero post-EOF data when extending file size Chao Yu <chao(a)kernel.org> f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Chen Changcheng <chenchangcheng(a)kylinos.cn> f2fs: fix valid block count leak on data block allocation failure Chao Yu <chao(a)kernel.org> f2fs: fix to clear dirty flag on folio in error path Chao Yu <chao(a)kernel.org> f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: fix i_size when pinned fallocate partially fails Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() Daeho Jeong <daehojeong(a)google.com> f2fs: fix to migrate all curseg types during free_segment_range Wenjie Qi <qwjhust(a)gmail.com> f2fs: avoid NULL checkpoint thread access in sysfs Guanghui Yang <3497809730(a)qq.com> f2fs: fix dentry folio leak in find_in_level Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential section-unaligned pinfile Wenjie Qi <qwjhust(a)gmail.com> f2fs: return writeback error from collapse range Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Joanne Chang <joannechien(a)google.com> f2fs: dirty directory inodes on mtime/ctime update Chao Yu <chao(a)kernel.org> f2fs: fix to avoid move_range and defragment on device_alias file Wenjie Qi <qwjhust(a)gmail.com> f2fs: only redirty pinned folios in redirty_blocks Hao-Qun Huang <alvinhuang0603(a)gmail.com> f2fs: reject overlapping move range after len expansion Wenjie Qi <qwjhust(a)gmail.com> f2fs: return symlink writeback errors Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Quiesce response IRQ before freeing request queue Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Initialize NVMe abort_work once at submission Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Set inst->std during default format initialization Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Guard bit depth check with initial_info_obtained Hungyu Lin <dennylin0707(a)gmail.com> media: qcom: iris: use disable_irq() during power-off Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: qcom: iris: fix state-change debug log printing stale value Ruoyu Wang <ruoyuw560(a)gmail.com> media: zoran: Avoid freeing a registered video_device twice Arash Golgol <arash.golgol(a)gmail.com> media: vimc: fix pixel format lookup in enum_framesizes Uday Khare <udaykhare77(a)gmail.com> media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya <birenpandya(a)gmail.com> media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ming Qian <ming.qian(a)oss.nxp.com> media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Xu Rao <raoxu(a)uniontech.com> media: v4l2-async: avoid deleting unlinked ASC entry on link error Ilya Krutskih <devsec(a)tpz.ru> media: tda18250: fix possible integer overflow Guangshuo Li <lgs201920130244(a)gmail.com> media: saa7164: fix cleanup on resource allocation failure Lei Huang <huanglei(a)kylinos.cn> media: s2255: check firmware size before reading trailing marker HyeongJun An <sammiee5311(a)gmail.com> media: s2255: bound JPEG frame size before copying into the buffer Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: rkvdec: Propagate platform_get_irq() errors Myeonghun Pak <mhun512(a)gmail.com> media: rc: sunxi-cir: Unregister rc device on probe failure Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Correct color map between V4L2 and ISI Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Johan Hovold <johan(a)kernel.org> media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Guangshuo Li <lgs201920130244(a)gmail.com> media: platform: mtk-mdp3: Fix SCP device refcounting Christian Hewitt <christianshewitt(a)gmail.com> media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder Cong Nguyen <congnt264(a)gmail.com> media: intel/ipu6: fix async notifier cleanup leak on parse error Dave Stevenson <dave.stevenson(a)raspberrypi.com> media: imx355: Avoid calling imx355_power_off twice in error path Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov7740: fix use-after-destroy in remove Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov02a10: fix endpoint parsing use-after-free Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Return test pattern write errors Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Release runtime PM reference on VBLANK error Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han <jiangong.han(a)windriver.com> media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> media: em28xx: defer audio-only extension registration Fan Wu <fanwu01(a)zju.edu.cn> media: cx23885: cancel NetUP CI work before teardown Bryam Vargas <hexlabsecurity(a)proton.me> media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang <ruoyuw560(a)gmail.com> media: cobalt: Avoid freeing ALSA private data twice Dawei Feng <dawei.feng(a)seu.edu.cn> media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang <ruoyuw560(a)gmail.com> media: cec: Serialize exclusive follower delivery Yi Ding <yi.s.ding(a)gmail.com> media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Hans Verkuil <hverkuil+cisco(a)kernel.org> media: cec: extron-da-hd-4k-plus: add sanity check Biren Pandya <birenpandya(a)gmail.com> media: cec: disable delayed work before freeing an interrupted transmit Jonas Karlman <jonas(a)kwiboo.se> media: cec: core: Fix kmemleak due to missed rc_free_device() call Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Remove obsolete frame_count check in venc_start_session Valery Borovsky <vebohr(a)gmail.com> media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Danilo Krummrich <dakr(a)kernel.org> rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> LoongArch: Avoid preempt count underflow without probe Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Do not save/restore percpu base register in rethook trampoline Nathan Chancellor <nathan(a)kernel.org> LoongArch: Do not select HAVE_RUST when KASAN is enabled Bibo Mao <maobibo(a)loongson.cn> LoongArch: Fix acpi_package_ids[] array overflow Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Refactor jump offset calculation in tail call Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Optimize redundant TCC loads in epilogue Han Gao <gaohan(a)iscas.ac.cn> LoongArch: Add DIRECT_MAP_PHYSMEM_END definition Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Free init resources if kvm_init() fails Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix TOCTOU race on pv_features Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly cap TLBI Range to the architural limit Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure Kajetan Puchalski <kajetan.puchalski(a)arm.com> KVM: arm64: vgic: Fix detection of MI on no pending LR Qihang <q.h.hack.winter(a)gmail.com> KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables Marc Zyngier <maz(a)kernel.org> KVM: arm64: Sign-extend VA for range-based TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly handle end of VA space TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Restore sigset on error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix length check __import_wp_info() Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Sean Christopherson <seanjc(a)google.com> KVM: x86: Serialize writes to disabled_quirks using kvm->lock Carlos López <clopez(a)suse.de> KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Yosry Ahmed <yosry(a)kernel.org> KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Always flush vpid02 on first use Amit Machhiwal <amachhiw(a)linux.ibm.com> KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Reject integration times with a non-zero seconds part Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix power down clearing bits of the wrong register Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Fix incorrect register name in threshold read error message Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Reject integration times with a non-zero seconds part Paul Geurts <paul.geurts(a)prodrive-technologies.com> iio: ti-ads7138: Disable STATS_EN bit while reading conversion results Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen <congnt264(a)gmail.com> iio: srf04: fix pm_runtime handling on probe error path Can Peng <pengcan(a)kylinos.cn> iio: pressure: mpl115: Fix runtime PM cleanup Rupesh Majhi <zoone.rupert(a)gmail.com> iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: ltrf216a: fix runtime PM reference leak in error path Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze <giorgi(a)tchankvetadze.com> iio: light: cm32181: return zero after writing calibscale Cong Nguyen <congnt264(a)gmail.com> iio: gyro: mpu3050: fix sign of raw angular velocity readings Erick Henrique <erick.henrique.rodrigues(a)usp.br> iio: dac: m62332: Fix regulator reference count imbalance Babanpreet Singh <bbnpreetsingh(a)gmail.com> iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show Linmao Li <lilinmao(a)kylinos.cn> iio: chemical: sgp30: Handle IAQ thread creation failure Fan Wu <fanwu01(a)zju.edu.cn> iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Tie IIO dma fence lock lifetime to the fence Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Make IIO DMA fence release RCU-safe Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Fix potential use-after-free in anonymous buffer release Cong Nguyen <congnt264(a)gmail.com> iio: adc: pac1921: fix wrong channel used in trigger handler read Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: adi-axi-adc: add data size support for AD408X backend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the Tegra264 register default table Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the MIXER enable default value Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort ADMAIF register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort MBDRC register defaults Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_mixer: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2780: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2764: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2552: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sti-sas: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sgtl5000: sort the register default table WenTao Liang <vulab(a)iscas.ac.cn> ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt721-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: drop duplicate reg_default entries Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-dmic: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt298: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt286: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt274: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1316-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1017-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pm4125-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pcm512x: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: ml26124: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: max9860: sort the register default table Binbin Zhou <zhoubinbin(a)loongson.cn> ASoC: loongson: Fix error handling in ACPI property parsing Haoxiang Li <haoxiang_li2024(a)163.com> AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: fsl_easrc: sort the register default table wangdicheng <wangdicheng(a)kylinos.cn> ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cx2072x: sort the register default table Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l33: drain threaded IRQ before runtime suspend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: adau1761: sort the register default table Linkai Gong <gonglinkai(a)kylinos.cn> i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Heiko Stuebner <heiko.stuebner(a)cherry.de> clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: align gxbb_32k_clk_sel number of parents with actual count Akari Tsuyukusa <akkun11.open(a)gmail.com> clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen Pavel Löbl <pavel(a)loebl.cz> clk: clocking-wizard: fix integer overflow in rate calculation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: avoid unaligned fault in IP extraction Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: linearize skbuff for packet generation Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: ensure unshared skb for multicast packets Zhiling Zou <zhilinz(a)nebusec.ai> batman-adv: fix stale receive device on merged fragments Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: rawnand: validate ONFI extended parameter page sections Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() Xu Rao <raoxu(a)uniontech.com> mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: afs: validate v2 image info bounds Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix NULL deref in status_show() during queue probe Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: stop watchdogs before booting kdump kernel Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Move H_WATCHDOG definitions to a common header Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Handle and log pseries-wdt registration failures Muchun Song <muchun.song(a)linux.dev> powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Fix null-ptr-def in extra size calculation Helge Deller <deller(a)gmx.de> parisc: Fix alignment of asm statements in head.S Pei Xiao <xiaopei01(a)kylinos.cn> parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas <hexlabsecurity(a)proton.me> nvdimm/btt: reject an arena whose nfree is below the lane count Narek Jilavyan <njilav(a)gmail.com> mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() Longlong Xia <xialonglong(a)kylinos.cn> mm/hugetlb: keep max_huge_pages when dissolving surplus folios Wupeng Ma <mawupeng1(a)huawei.com> mm/hugetlb: fix missing migratable flag on same-node hugetlb migration caina <caina(a)uniontech.com> Revert "irqchip/mbigen: Fix mbigen node address layout" Christian Marangi <ansuelsmth(a)gmail.com> pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Kazuki Hanai <hnkz.64(a)gmail.com> nvmet-auth: Synchronize timeout work during SQ teardown Tristan Madani <tristan(a)talencesecurity.com> nvme: add missing SRCU grace period in error path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: check the data direction of a C2HData PDU Niklas Cassel <cassel(a)kernel.org> nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Xu Rao <raoxu(a)uniontech.com> nvme-fabrics: fix DHCHAP secret leak on parse failure Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix race between non-atomic ops and trigger-start Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: harmony: initialize locks before requesting IRQ HyeongJun An <sammiee5311(a)gmail.com> ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Khushit Shah <khushit.shah(a)nutanix.com> arm64: errata: pass REVIDR when matching target implementation CPUs Karl Mehltretter <kmehltretter(a)gmail.com> arm64: mm: Fix the lockless page-table walk in show_pte() Ahmad Byagowi <ahmadexp(a)gmail.com> i2c: mux: Fix channel node leak on adapter add failure Vasileios Almpanis <vasilisalmpanis(a)gmail.com> i2c: core: fix debugfs UAF on adapter removal Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> i2c: qcom-geni: update frequency table to fix timing parameters Hongbo Yao <andy.xu(a)hj-micro.com> i2c: designware: Enable interrupt mask workaround for HJMC3001 Sizhe Liu <liusizhe5(a)huawei.com> perf hisi-ptt: Fix PTT trace TLP header parsing Viktor Malik <vmalik(a)redhat.com> perf trace: Refactor augmented_raw_syscalls using bpf_for Viktor Malik <vmalik(a)redhat.com> perf trace: Factor out BPF loop body Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Fix kernel address leakages in LBR stack Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt Shakeel Butt <shakeel.butt(a)linux.dev> memcg: make the v1 soft limit knob inert Shakeel Butt <shakeel.butt(a)linux.dev> memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: aiptek - validate raw macro indices before updating state HE WEI（ギカク） <skyexpoc(a)gmail.com> fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Nirbhay Sharma <nirbhay.lkd(a)gmail.com> fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Eric Dumazet <edumazet(a)google.com> mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> kprobes: Protect kprobe_blacklist with RCU Ju Nan <junan76(a)163.com> irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Bradley Morgan <brads(a)mainlining.org> ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Hajo Noerenberg <hajo-linux-ide(a)noerenberg.de> ata: ahci: work around lost interrupts on Marvell 88SE61xx Max Kellermann <max.kellermann(a)ionos.com> ceph: lock mutex in ceph_mds_check_access() Hui Su <sh_def(a)163.com> bpf: Fix infinite loop in pcpu_freelist push with one possible CPU Damien Le Moal <dlemoal(a)kernel.org> block: flag zoned disks with GENHD_FL_NO_PART Ulf Hansson <ulf.hansson(a)oss.qualcomm.com> cpuidle: psci: Fix support for probe deferral by dropping the faux device Linkai Gong <gonglinkai(a)kylinos.cn> cpuidle: dt_idle_genpd: kfree() the original name allocation Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Complete descriptors before pausing Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Fix HDMA channel status register access Martin Kaiser <martin(a)kaiser.cx> dmaengine: fsl-edma: tracing: no ptr dereference during log output Aneesh Kumar K.V (Arm) <aneesh.kumar(a)kernel.org> dma-direct: return struct page from dma_direct_alloc_from_pool() Mikulas Patocka <mpatocka(a)redhat.com> dm: fix resume-vs-remove race Mikulas Patocka <mpatocka(a)redhat.com> dm: fix race when loading and unloading a table Ibrahim Hashimov <security(a)auditcode.ai> HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie(a)gmail.com> HID: rmi: fix OOB access with undersized RMI reports Shen Yongchao <grayhat(a)foxmail.com> HID: bpf: serialize device reference release in struct_ops destroy path Steven Rostedt <rostedt(a)goodmis.org> ftrace: Synchronize the initialization of ftrace_ops Yao Kai <yaokai34(a)huawei.com> futex: Prevent rcuwait use-after-free during requeue PI SJ Park <sj(a)kernel.org> mm/damon/core-kunit: check region count before testing in split_at() SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() region and target (error) dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme region dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme filter dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs SJ Park <sj(a)kernel.org> samples/damon/wsse: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/wsse: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/prcl: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/prcl: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_stop() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_start() failure SJ Park <sj(a)kernel.org> mm/damon/vaddr-kunit: check region count in three_regions test Runyu Xiao <runyu.xiao(a)seu.edu.cn> scsi: pm8001: Use rollback index when freeing MSI-X vectors Thomas Lamprecht <t.lamprecht(a)proxmox.com> scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame Sujal Tuladhar <sujaltuladhar1231(a)gmail.com> scsi: target: iscsi: Reserve a terminator byte for the login payload Honghui Jiang <jiang_hh2019(a)163.com> spi: Fix DMA mapping ownership on partial map failure Can Peng <pengcan(a)kylinos.cn> spi: bcmbca-hsspi: disable clocks on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx: disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx-hsspi: disable clocks on resume failure Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size Kanishka De Silva <kpskanna1915(a)gmail.com> ublk: clear VM_MAYWRITE on read-only ublk char device mmap Bryan Lim <foxieflakey(a)gmail.com> userfaultfd: reset err to be 0 when move_pages_ptes succeeded Can Peng <pengcan(a)kylinos.cn> thermal/drivers/qoriq: Disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> thermal/drivers/imx: Disable clock on runtime resume failure Arthur Gautier <baloo(a)superbaloo.net> xhci: fix lost bounce buffers on TDs spanning several ring segments Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki <lovekeshsolanki00(a)gmail.com> USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_midi: initialize work in f_midi_alloc() Ivy Lopez <skunkolee(a)gmail.com> usb: gadget: f_midi2: fix use-after-free in string attribute show path Aleksandr Nogikh <nogikh(a)google.com> usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Jameson Thies <jthies(a)google.com> usb: typec: ucsi: displayport: Fix OOB altmode array index Sven Peter <sven(a)kernel.org> usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic: cancel reset_work on stop Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Myeonghun Pak <mhun512(a)gmail.com> usb: storage: realtek_cr: fix use-after-free on disconnect Elson Serrao <elson.serrao(a)oss.qualcomm.com> usb: dwc3: clear forceRM when issuing EndTransfer Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Liu Qi <liuqi(a)longcheer.com> usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: usbtv: keep device alive while ALSA card exists Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset HyeongJun An <sammiee5311(a)gmail.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: image: mdc800: change kmalloc() to kzalloc() Hari Mishal <harimishal1(a)gmail.com> drm/amd/display: fix division by zero in get_estimated_bw() Anton Protopopov <a.s.protopopov(a)gmail.com> bpf: fix the return value of push_stack Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Sun Jian <sun.jian.kdev(a)gmail.com> fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Drop calls to restore power limit and clock from smu_resume() Ali Ahmet Memis <ali(a)iusegentoo.com> mfd: qnap-mcu: keep the reply buffer alive past a command timeout FUJITA Tomonori <fujita.tomonori(a)gmail.com> objtool/rust: add one more `noreturn` Rust function Youngjae Kwon <yjkwon0026(a)snu.ac.kr> fsnotify: Fix stale object mask after concurrent mark updates Jinjie Ruan <ruanjinjie(a)huawei.com> entry: Fix seccomp bypass after ptrace with TSYNC Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Yuqi Xu <xuyuqiabc(a)gmail.com> openvswitch: Fix CT limit teardown use-after-free Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() ------------- Diffstat: Documentation/ABI/testing/sysfs-kernel-mm-damon | 8 +- Documentation/admin-guide/cgroup-v1/memory.rst | 49 +-- Documentation/trace/hisi-ptt.rst | 28 +- .../media/v4l/ext-ctrls-colorimetry.rst | 12 +- Makefile | 4 +- arch/arm64/include/asm/kvm_nested.h | 20 ++ arch/arm64/kernel/cpu_errata.c | 2 +- arch/arm64/kvm/at.c | 2 - arch/arm64/kvm/nested.c | 94 ++++-- arch/arm64/kvm/sys_regs.c | 11 + arch/arm64/kvm/vgic/vgic-init.c | 1 + arch/arm64/kvm/vgic/vgic-its.c | 8 + arch/arm64/kvm/vgic/vgic-v3-nested.c | 2 +- arch/arm64/kvm/vgic/vgic-v3.c | 12 +- arch/arm64/mm/fault.c | 12 +- arch/loongarch/Kconfig | 2 +- arch/loongarch/include/asm/kvm_host.h | 1 + arch/loongarch/include/asm/pgtable.h | 7 + arch/loongarch/kernel/acpi.c | 3 +- arch/loongarch/kernel/kprobes.c | 3 + arch/loongarch/kernel/rethook_trampoline.S | 2 - arch/loongarch/kvm/exit.c | 1 - arch/loongarch/kvm/main.c | 6 +- arch/loongarch/kvm/mmu.c | 10 + arch/loongarch/kvm/vcpu.c | 6 +- arch/loongarch/kvm/vm.c | 1 + arch/loongarch/net/bpf_jit.c | 22 +- arch/parisc/kernel/head.S | 1 + arch/powerpc/include/asm/papr-watchdog.h | 64 ++++ arch/powerpc/include/asm/reg.h | 12 + arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/kexec/ranges.c | 12 +- arch/powerpc/kvm/book3s_hv.c | 15 +- arch/powerpc/kvm/powerpc.c | 6 + arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +- arch/powerpc/platforms/pseries/setup.c | 28 +- arch/s390/include/asm/nmi.h | 3 + arch/s390/kernel/nmi.c | 5 +- arch/s390/kvm/guestdbg.c | 9 +- arch/s390/kvm/interrupt.c | 26 +- arch/s390/kvm/kvm-s390.c | 15 +- arch/x86/events/intel/lbr.c | 12 +- arch/x86/kernel/rtc.c | 4 + arch/x86/kvm/hyperv.c | 25 +- arch/x86/kvm/mmu/mmu.c | 102 +++--- arch/x86/kvm/mmu/tdp_iter.h | 7 + arch/x86/kvm/mmu/tdp_mmu.c | 20 +- arch/x86/kvm/vmx/nested.c | 75 +++-- arch/x86/kvm/x86.c | 5 +- arch/x86/kvm/x86.h | 2 +- block/genhd.c | 7 + drivers/acpi/acpi_pnp.c | 2 +- drivers/acpi/acpi_tad.c | 186 +++++++---- drivers/acpi/cppc_acpi.c | 13 +- drivers/acpi/x86/cmos_rtc.c | 13 +- drivers/ata/ahci.c | 49 +++ drivers/block/ublk_drv.c | 6 + drivers/block/zram/zram_drv.c | 65 ++-- drivers/block/zram/zram_drv.h | 1 - drivers/clk/mediatek/Kconfig | 1 + drivers/clk/meson/gxbb.c | 2 +- drivers/clk/qcom/gcc-mdm9607.c | 182 +---------- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 4 +- drivers/cpufreq/apple-soc-cpufreq.c | 36 +-- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/cpuidle/cpuidle-psci.c | 42 +-- drivers/cpuidle/dt_idle_genpd.c | 3 +- drivers/crypto/atmel-ecc.c | 50 ++- drivers/crypto/intel/iaa/iaa_crypto_main.c | 138 ++++---- drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 + drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/cxl/core/Makefile | 1 + drivers/cxl/core/core.h | 11 +- drivers/cxl/core/mbox.c | 8 - drivers/cxl/core/mce.c | 27 +- drivers/cxl/core/pci.c | 115 ------- drivers/cxl/core/ras_rch.c | 136 ++++++++ drivers/cxl/core/region.c | 122 ++++--- drivers/cxl/cxl.h | 9 +- drivers/cxl/cxlmem.h | 2 - drivers/dax/Makefile | 3 +- drivers/dax/cxl.c | 27 +- drivers/dma/dw-edma/dw-edma-core.c | 23 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +- drivers/dma/fsl-edma-trace.h | 4 +- drivers/firmware/qcom/qcom_scm.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 56 ++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 13 + .../display/dc/link/protocols/link_dp_dpia_bw.c | 5 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 13 - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 +--- drivers/gpu/drm/i915/i915_pci.c | 3 + drivers/gpu/drm/msm/dsi/dsi_host.c | 12 + drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 13 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c | 191 +++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 17 + drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 86 ++++- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 129 +++----- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/disp.c | 64 ++++ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 9 + .../nouveau/nvkm/subdev/gsp/rm/r570/nvrm/disp.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 5 + drivers/gpu/drm/panel/panel-edp.c | 19 +- drivers/gpu/drm/panthor/panthor_fw.c | 22 +- drivers/gpu/drm/solomon/ssd130x.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sysfb/ofdrm.c | 8 +- drivers/gpu/drm/sysfb/simpledrm.c | 74 ++++- drivers/gpu/drm/xe/xe_vram.c | 26 +- drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +- drivers/hid/hid-mcp2221.c | 15 +- drivers/hid/hid-rmi.c | 46 ++- drivers/hid/hid-sony.c | 78 ++--- drivers/hid/wacom_wac.c | 13 + drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/i2c-core-base.c | 6 + drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/iio/adc/Kconfig | 1 + drivers/iio/adc/adi-axi-adc.c | 30 ++ drivers/iio/adc/pac1921.c | 2 +- drivers/iio/adc/ti-ads7138.c | 42 ++- drivers/iio/chemical/atlas-sensor.c | 19 +- drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/industrialio-buffer.c | 38 ++- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 10 +- drivers/iio/light/ltrf216a.c | 3 +- drivers/iio/light/opt4001.c | 37 +-- drivers/iio/light/opt4060.c | 5 +- drivers/iio/pressure/dps310.c | 3 +- drivers/iio/pressure/mpl115.c | 11 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/infiniband/hw/ionic/ionic_hw_stats.c | 95 +++--- drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 +- drivers/input/tablet/aiptek.c | 13 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 14 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-stm32mp-exti.c | 4 +- drivers/md/dm.c | 14 +- drivers/media/cec/core/cec-adap.c | 10 +- drivers/media/cec/core/cec-core.c | 2 - drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + .../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +- drivers/media/i2c/alvium-csi2.c | 2 +- drivers/media/i2c/imx355.c | 3 +- drivers/media/i2c/imx415.c | 4 +- drivers/media/i2c/ov02a10.c | 12 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 + drivers/media/pci/saa7164/saa7164-core.c | 8 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/venc.c | 2 - .../platform/chips-media/wave5/wave5-vpu-dec.c | 3 +- .../platform/chips-media/wave5/wave5-vpu-enc.c | 6 +- .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 6 +- .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 6 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/qcom/iris/iris_state.c | 2 +- drivers/media/platform/qcom/iris/iris_vidc.c | 11 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 5 + drivers/media/platform/rockchip/rkvdec/rkvdec.c | 4 +- drivers/media/rc/sunxi-cir.c | 9 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 + drivers/media/usb/usbtv/usbtv-audio.c | 11 + drivers/media/v4l2-core/v4l2-async.c | 1 - drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 ++- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/mfd/qnap-mcu.c | 13 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/nand/ecc-realtek.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 +- drivers/mtd/parsers/afs.c | 7 + drivers/nvdimm/btt.c | 8 + drivers/nvme/host/core.c | 3 + drivers/nvme/host/fabrics.c | 2 + drivers/nvme/host/fc.c | 26 +- drivers/nvme/host/tcp.c | 7 + drivers/nvme/target/auth.c | 6 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/nvmet.h | 2 + drivers/nvme/target/tcp.c | 10 + drivers/parisc/eisa.c | 5 + drivers/pci/controller/plda/pcie-starfive.c | 36 ++- drivers/pmdomain/mediatek/Kconfig | 5 +- drivers/power/supply/ab8500_fg.c | 32 +- drivers/remoteproc/qcom_q6v5_pas.c | 9 +- drivers/rtc/rtc-cmos.c | 10 + drivers/rtc/rtc-rzn1.c | 30 +- drivers/s390/crypto/vfio_ap_ops.c | 203 ++++++++---- drivers/scsi/fnic/fip.c | 2 +- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +- drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 6 +- drivers/scsi/qla2xxx/qla_bsg.c | 39 ++- drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_edif.c | 3 + drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 61 +++- drivers/scsi/qla2xxx/qla_inline.h | 13 + drivers/scsi/qla2xxx/qla_isr.c | 39 ++- drivers/scsi/qla2xxx/qla_mbx.c | 28 +- drivers/scsi/qla2xxx/qla_nvme.c | 31 +- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/soc/qcom/qcom-geni-se.c | 24 +- drivers/spi/spi-bcm63xx-hsspi.c | 8 +- drivers/spi/spi-bcm63xx.c | 6 +- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi.c | 34 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 + drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/thermal/imx_thermal.c | 9 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 21 +- drivers/usb/gadget/function/f_fs.c | 31 +- drivers/usb/gadget/function/f_mass_storage.c | 2 +- drivers/usb/gadget/function/f_midi.c | 2 +- drivers/usb/gadget/function/f_midi2.c | 17 +- drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/host/xhci-debugfs.c | 21 +- drivers/usb/host/xhci-hub.c | 117 ++++--- drivers/usb/host/xhci-mem.c | 34 +- drivers/usb/host/xhci-pci.c | 6 +- drivers/usb/host/xhci-ring.c | 40 ++- drivers/usb/host/xhci-tegra.c | 12 +- drivers/usb/host/xhci-trace.h | 5 + drivers/usb/host/xhci.c | 81 +++-- drivers/usb/host/xhci.h | 46 ++- drivers/usb/image/mdc800.c | 4 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/storage/realtek_cr.c | 9 +- .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 28 +- drivers/usb/typec/tipd/core.c | 17 +- drivers/usb/typec/tipd/tps6598x.h | 4 +- drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/watchdog/pseries-wdt.c | 53 +-- drivers/xen/balloon.c | 56 ++-- fs/afs/callback.c | 1 + fs/ceph/caps.c | 63 +++- fs/ceph/crypto.c | 46 ++- fs/ceph/mds_client.c | 71 +++- fs/ceph/mds_client.h | 2 + fs/ceph/super.h | 13 + fs/erofs/zutil.c | 2 + fs/f2fs/data.c | 5 +- fs/f2fs/dir.c | 7 +- fs/f2fs/file.c | 154 ++++++--- fs/f2fs/gc.c | 2 +- fs/f2fs/inline.c | 2 +- fs/f2fs/namei.c | 17 +- fs/f2fs/node.c | 9 +- fs/f2fs/sysfs.c | 7 +- fs/f2fs/xattr.c | 2 +- fs/fuse/args.h | 65 ++++ fs/fuse/cuse.c | 7 +- fs/fuse/dev.c | 44 +-- fs/fuse/dev_uring.c | 189 +++++++---- fs/fuse/file.c | 22 +- fs/fuse/fuse_i.h | 53 +-- fs/fuse/inode.c | 10 +- fs/lockd/svcsubs.c | 2 +- fs/nfsd/filecache.c | 115 +++---- fs/nfsd/netns.h | 11 +- fs/nfsd/nfs4proc.c | 139 ++++++-- fs/nfsd/nfs4state.c | 170 +++++++--- fs/nfsd/nfsctl.c | 25 +- fs/nfsd/nfsd.h | 15 - fs/nfsd/state.h | 2 +- fs/notify/fanotify/fanotify_user.c | 12 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ntfs3/frecord.c | 20 +- fs/ocfs2/dir.c | 71 +++- fs/overlayfs/dir.c | 1 - fs/pidfs.c | 136 +++++--- fs/smb/client/cifs_debug.c | 4 +- fs/smb/client/cifs_spnego.h | 2 - fs/smb/client/cifs_unicode.h | 3 - fs/smb/client/cifsfs.c | 5 +- fs/smb/client/cifsfs.h | 6 +- fs/smb/client/cifsglob.h | 10 +- fs/smb/client/cifsproto.h | 29 +- fs/smb/client/cifssmb.c | 146 +++++++++ fs/smb/client/compress.c | 21 +- fs/smb/client/compress.h | 19 +- fs/smb/client/connect.c | 142 -------- fs/smb/client/dir.c | 2 +- fs/smb/client/dns_resolve.h | 4 - fs/smb/client/fs_context.c | 2 +- fs/smb/client/fs_context.h | 16 +- fs/smb/client/fscache.h | 10 +- fs/smb/client/inode.c | 61 +++- fs/smb/client/misc.c | 1 + fs/smb/client/netmisc.c | 2 +- fs/smb/client/smb1ops.c | 171 ---------- fs/smb/client/smb1proto.h | 40 +++ fs/smb/client/smb1transport.c | 198 ++++++++++++ fs/smb/client/smb2file.c | 3 +- fs/smb/client/smb2inode.c | 1 - fs/smb/client/smb2maperror.c | 3 +- fs/smb/client/smb2ops.c | 99 ++++-- fs/smb/client/smb2pdu.c | 5 +- fs/smb/client/smb2proto.h | 14 +- fs/smb/client/trace.h | 151 +++++++++ fs/smb/server/oplock.c | 61 +++- include/linux/acpi.h | 14 + include/linux/firmware/qcom/qcom_scm.h | 10 +- include/linux/huge_mm.h | 7 +- include/linux/hugetlb.h | 5 + include/linux/kprobes.h | 1 + include/linux/lockd/lockd.h | 2 +- include/linux/memcontrol.h | 10 + include/linux/mm.h | 2 - include/linux/rmap.h | 9 +- include/linux/soc/qcom/geni-se.h | 4 + include/net/dst.h | 6 + include/net/ip.h | 25 ++ include/net/ip6_route.h | 43 +++ include/net/ipv6.h | 10 +- include/net/tcp.h | 5 + kernel/bpf/percpu_freelist.c | 35 +- kernel/bpf/percpu_freelist.h | 1 + kernel/bpf/stackmap.c | 173 ++++++---- kernel/bpf/verifier.c | 81 ++--- kernel/dma/direct.c | 18 +- kernel/entry/syscall-common.c | 3 + kernel/futex/requeue.c | 12 +- kernel/kprobes.c | 14 +- kernel/sched/core.c | 60 ++-- kernel/sched/deadline.c | 8 +- kernel/sched/ext.c | 17 +- kernel/sched/fair.c | 4 +- kernel/sched/idle.c | 2 +- kernel/sched/rt.c | 8 +- kernel/sched/sched.h | 12 +- kernel/sched/stop_task.c | 2 +- kernel/trace/ftrace.c | 13 +- kernel/trace/ring_buffer.c | 20 +- mm/damon/core.c | 22 +- mm/damon/ops-common.c | 5 +- mm/damon/paddr.c | 20 +- mm/damon/sysfs-schemes.c | 18 +- mm/damon/sysfs.c | 23 +- mm/damon/tests/core-kunit.h | 15 +- mm/damon/tests/vaddr-kunit.h | 5 + mm/damon/vaddr.c | 34 +- mm/huge_memory.c | 358 ++++++++++++--------- mm/hugetlb.c | 25 +- mm/hugetlb_cgroup.c | 7 +- mm/hugetlb_vmemmap.c | 298 +++++++---------- mm/memcontrol-v1.c | 43 ++- mm/memcontrol.c | 13 + mm/mempolicy.c | 2 +- mm/migrate.c | 12 +- mm/mm_init.c | 1 + mm/page_alloc.c | 6 +- mm/page_vma_mapped.c | 8 +- mm/rmap.c | 15 +- mm/slab.h | 8 +- mm/slab_common.c | 44 ++- mm/slub.c | 108 +++---- mm/sparse-vmemmap.c | 53 --- mm/userfaultfd.c | 4 +- mm/vmscan.c | 41 +-- net/8021q/vlan.c | 7 +- net/8021q/vlan_dev.c | 32 +- net/batman-adv/bridge_loop_avoidance.c | 15 +- net/batman-adv/distributed-arp-table.c | 8 +- net/batman-adv/main.c | 4 + net/batman-adv/multicast_forw.c | 7 +- net/core/skbuff.c | 5 +- net/ipv4/icmp.c | 2 +- net/ipv4/ip_output.c | 4 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ipmr.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ipv4.c | 15 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/exthdrs.c | 55 ++-- net/ipv6/ip6_gre.c | 2 +- net/ipv6/ip6_output.c | 47 +-- net/ipv6/ip6_tunnel.c | 6 +- net/ipv6/ipv6_sockglue.c | 4 +- net/ipv6/route.c | 10 +- net/ipv6/sit.c | 2 +- net/ipv6/tcp_ipv6.c | 11 +- net/openvswitch/conntrack.c | 121 ++++--- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 10 +- net/openvswitch/datapath.h | 8 +- net/packet/af_packet.c | 96 +++++- net/sunrpc/auth_gss/gss_rpc_xdr.c | 9 +- net/sunrpc/xprtrdma/ib_client.c | 26 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 12 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 5 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 32 +- rust/kernel/bug.rs | 10 +- rust/kernel/devres.rs | 163 ++++------ rust/kernel/drm/ioctl.rs | 6 + samples/damon/mtier.c | 14 +- samples/damon/prcl.c | 11 +- samples/damon/wsse.c | 11 +- security/integrity/ima/ima_appraise.c | 2 + sound/core/pcm_native.c | 2 + sound/core/rawmidi.c | 2 +- sound/parisc/harmony.c | 6 +- sound/soc/codecs/adau1761.c | 34 +- sound/soc/codecs/aw88261.c | 30 +- sound/soc/codecs/aw88261.h | 6 - sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/codecs/cx2072x.c | 134 ++++---- sound/soc/codecs/hdac_hda.c | 4 +- sound/soc/codecs/max9860.c | 2 +- sound/soc/codecs/ml26124.c | 4 +- sound/soc/codecs/pcm512x.c | 40 +-- sound/soc/codecs/pm4125-sdw.c | 2 +- sound/soc/codecs/rt1017-sdca-sdw.h | 10 +- sound/soc/codecs/rt1316-sdw.c | 2 +- sound/soc/codecs/rt1318-sdw.c | 2 +- sound/soc/codecs/rt1318.c | 4 +- sound/soc/codecs/rt274.c | 8 +- sound/soc/codecs/rt286.c | 14 +- sound/soc/codecs/rt298.c | 14 +- sound/soc/codecs/rt700-sdw.h | 11 +- sound/soc/codecs/rt711-sdca-sdw.h | 6 +- sound/soc/codecs/rt711-sdw.h | 10 +- sound/soc/codecs/rt712-sdca-dmic.h | 6 +- sound/soc/codecs/rt712-sdca-sdw.h | 11 +- sound/soc/codecs/rt715-sdca-sdw.h | 48 ++- sound/soc/codecs/rt715-sdw.h | 32 +- sound/soc/codecs/rt721-sdca-sdw.h | 44 +-- sound/soc/codecs/sgtl5000.c | 2 +- sound/soc/codecs/sti-sas.c | 2 +- sound/soc/codecs/tas2552.c | 14 +- sound/soc/codecs/tas2764.c | 2 +- sound/soc/codecs/tas2780.c | 2 +- sound/soc/codecs/tas2783-sdw.c | 177 +++++----- sound/soc/fsl/fsl_easrc.c | 8 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/loongson/loongson_card.c | 6 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/soc/tegra/tegra210_admaif.c | 210 ++++++++---- sound/soc/tegra/tegra210_i2s.c | 8 +- sound/soc/tegra/tegra210_mbdrc.c | 42 +-- sound/soc/tegra/tegra210_mixer.c | 10 +- sound/usb/midi.c | 2 + tools/objtool/check.c | 3 +- .../util/bpf_skel/augmented_raw_syscalls.bpf.c | 155 +++++---- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 +-- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 + tools/sched_ext/scx_qmap.bpf.c | 2 +- tools/testing/cxl/Kbuild | 1 + 511 files changed, 7548 insertions(+), 4554 deletions(-)

2 months

[PATCH 7.2 000/556] 7.2.5-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.5 release. There are 556 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Sep 2026 13:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.5-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.5-rc1 Farhan Ali <alifm(a)linux.ibm.com> PCI: Allow per function PCI slots to fix slot reset on s390 Farhan Ali <alifm(a)linux.ibm.com> PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value SJ Park <sj(a)kernel.org> mm/damon/vaddr: drop last same folio access check optimization SJ Park <sj(a)kernel.org> mm/damon/paddr: drop last same folio access check reuse optimization SJ Park <sj(a)kernel.org> mm/damon/ops-common: use nr_accesses moving sum for quota score SJ Park <sj(a)kernel.org> mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ab8500_fg: fix use-after-free on remove Pan Chuang <panchuang(a)vivo.com> power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check Chuck Lever <cel(a)kernel.org> rpcrdma: arm rn_done before publishing the notification Jiri Olsa <jolsa(a)kernel.org> bpf: Disable preemption in bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Use stack id functions instead of __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_new_bucket from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_fastpath function from __bpf_get_stackid Jiri Olsa <jolsa(a)kernel.org> bpf: Factor stackid_init function from __bpf_get_stackid Abdifatah Suruur <suruurism(a)gmail.com> ksmbd: fix use-after-free in oplock break notification Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: fix vblank interrupts on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix head state readback on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: fix HDMI vendor infoframes on GB20x Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Faith Ekstrand <faith.ekstrand(a)collabora.com> drm/nouveau: Use write-combined maps for coherent Marek Czernohous <marek(a)czernohous.de> drm/nouveau: unsubscribe the channel-kill event before the fence context Mohamed Ahmed <mohamedahmedegypt2001(a)gmail.com> drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Zhenhao Wan <whi4ed0g(a)gmail.com> drm/nouveau/dmem: fix callocated underflow on large folio split Matthew Brost <matthew.brost(a)intel.com> drm/pagemap: Fix folio allocation fallback and use-after-put Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug Shixiong Ou <oushixiong(a)kylinos.cn> drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve stride validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve panel-size validation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: simpledrm: Improve framebuffer-size validation Sunday Clement <Sunday.Clement(a)amd.com> drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram Mario Limonciello <mario.limonciello(a)amd.com> drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Fix error path at svm_migrate_copy_to_ram Priya Hosur <Priya.Hosur(a)amd.com> drm/amdkfd: Add TLB flush after MES queue eviction/suspension Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx12 userqueues Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: update the fw version for gfx11 userqueues Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Skip accessing psp rum time db for APUs Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: force complete the MES ring fences on reset Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: force complete the KIQ ring fences on reset Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: fix Idle BOs list in VM debugfs status info Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump Guangshuo Li <lgs201920130244(a)gmail.com> drm/amdgpu: fix autosuspend cleanup during removal Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: Disable runtime PM for externally attached dGPUs Xiang Liu <xiang.liu(a)amd.com> drm/amdgpu: clamp the isolation index for rings outside a partition Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: delay ttm buffer func enablement on xgmi Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check thunderbolt before switcheroo registration Matthew Brost <matthew.brost(a)intel.com> drm/ttm: Drop tt->restore after successful restore Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Kavan Smith <kavansmith82(a)gmail.com> drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Tao Yu <tao1.yu(a)intel.com> drm/gud: validate TV mode names before creating enum property Deepanshu Kartikey <kartikey406(a)gmail.com> drm/gud: NUL-terminate TV mode names read from the device David (Ming Qiang) Wu <David.Wu3(a)amd.com> drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: only apply compute quantums to KCQs Roman Li <Roman.Li(a)amd.com> drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 Austin Zheng <Austin.Zheng(a)amd.com> drm/amd/display: Remove const Qualifier From Non-Pointer Fields Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: validate plane degamma LUT size for private color prop Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE Linkai Gong <gonglinkai(a)kylinos.cn> drm/amd/display: fix dc_lock leak on GPU reset error paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: avoid divide-by-zero in __is_lut_linear() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Use drm_atomic_helper_check_plane_state() Thomas Zimmermann <tzimmermann(a)suse.de> drm/hibmc: Fix list of formats on the primary plane Lyude Paul <lyude(a)redhat.com> drm/nouveau/disp/r535: Add scanline position support + head state support Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates in ssd133x Wentao Liang <vulab(a)iscas.ac.cn> drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Amit Barzilai <amit.barzilai22(a)gmail.com> drm/ssd130x: fix column and row end address in partial updates for ssd132x Deepanshu Kartikey <kartikey406(a)gmail.com> drm/i915: Guard against NULL driver_data in i915_pci_probe() Nemesa Garg <nemesa.garg(a)intel.com> drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable Danilo Krummrich <dakr(a)kernel.org> drm: fix race between partial drm_dev_register() failure and ioctl Johan Hovold <johan(a)kernel.org> drm/panel-edp: fix i2c adapter leak on probe failure Johan Hovold <johan(a)kernel.org> drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: fix firmware control interface bounds checks Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: harden firmware build-info bounds checks Matthew Auld <matthew.auld(a)intel.com> drm/xe/vram: report FLAT_CCS base misalignment Bob Zhou <bobzhou2(a)amd.com> drm/amdgpu: avoid force-completing uninitialized UVD rings Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Chao Yu <chao(a)kernel.org> f2fs: fix to zero post-EOF data when extending file size Chao Yu <chao(a)kernel.org> f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Chao Yu <chao(a)kernel.org> f2fs: fix to reclaim space in f2fs_allocate_pinning_section() Chen Changcheng <chenchangcheng(a)kylinos.cn> f2fs: fix valid block count leak on data block allocation failure Wenjie Qi <qwjhust(a)gmail.com> f2fs: protect critical_task_priority updates with s_umount Chao Yu <chao(a)kernel.org> f2fs: fix to clear dirty flag on folio in error path Chao Yu <chao(a)kernel.org> f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Chao Yu <chao(a)kernel.org> f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: fix i_size when pinned fallocate partially fails Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() Daeho Jeong <daehojeong(a)google.com> f2fs: fix to migrate all curseg types during free_segment_range Wenjie Qi <qwjhust(a)gmail.com> f2fs: avoid NULL checkpoint thread access in sysfs Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> f2fs: fix folio_nr_pages() race after put in large folio invalidate Guanghui Yang <3497809730(a)qq.com> f2fs: fix dentry folio leak in find_in_level Chao Yu <chao(a)kernel.org> f2fs: embed f2fs_gc_kthread in f2fs_sb_info Chao Yu <chao(a)kernel.org> f2fs: fix to avoid potential section-unaligned pinfile Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: don't drop the top folio order in the f2fs_iostat tracepoint Wenjie Qi <qwjhust(a)gmail.com> f2fs: limit recovery filename logging to stored length Wenjie Qi <qwjhust(a)gmail.com> f2fs: return writeback error from collapse range Zhan Xusheng <zhanxusheng1024(a)gmail.com> f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Joanne Chang <joannechien(a)google.com> f2fs: dirty directory inodes on mtime/ctime update Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate MOVE_RANGE destination size Chao Yu <chao(a)kernel.org> f2fs: fix to avoid move_range and defragment on device_alias file Wenjie Qi <qwjhust(a)gmail.com> f2fs: only redirty pinned folios in redirty_blocks Hao-Qun Huang <alvinhuang0603(a)gmail.com> f2fs: reject overlapping move range after len expansion Wenjie Qi <qwjhust(a)gmail.com> f2fs: return symlink writeback errors Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Avoid double completion in async IOCB timeout Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Quiesce response IRQ before freeing request queue Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Don't query firmware state while chip is down Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Serialize flash version read in reset handler Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Initialize NVMe abort_work once at submission Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix BSG job leak on validate flash image error path Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Bound i2c->length in I2C bsg handlers Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Resume device before setting EOS flag Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Fix pipeline stall when queuing fails Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Add timeout while stop_streaming Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: avoid skipping device_run while VPU has work Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Set inst->std during default format initialization Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Guard bit depth check with initial_info_obtained Wangao Wang <wangao.wang(a)oss.qualcomm.com> media: qcom: iris: fix missing hfi_id in gen1 GOP_SIZE cap Hungyu Lin <dennylin0707(a)gmail.com> media: qcom: iris: use disable_irq() during power-off Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: qcom: iris: fix state-change debug log printing stale value Ruoyu Wang <ruoyuw560(a)gmail.com> media: zoran: Avoid freeing a registered video_device twice Arash Golgol <arash.golgol(a)gmail.com> media: vimc: fix pixel format lookup in enum_framesizes Uday Khare <udaykhare77(a)gmail.com> media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size calculation in parse_raw_formats() Mohammed EL Kadiri <med08elkadiri(a)gmail.com> media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Biren Pandya <birenpandya(a)gmail.com> media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Ming Qian <ming.qian(a)oss.nxp.com> media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Michael Bommarito <michael.bommarito(a)gmail.com> media: v4l2-ctrls: validate HEVC EXT SPS RPS counts Xu Rao <raoxu(a)uniontech.com> media: v4l2-async: avoid deleting unlinked ASC entry on link error Fan Wu <fanwu01(a)zju.edu.cn> media: ti: vpe: quiesce overflow recovery before freeing streams Ilya Krutskih <devsec(a)tpz.ru> media: tda18250: fix possible integer overflow Guangshuo Li <lgs201920130244(a)gmail.com> media: saa7164: fix cleanup on resource allocation failure Lei Huang <huanglei(a)kylinos.cn> media: s2255: check firmware size before reading trailing marker HyeongJun An <sammiee5311(a)gmail.com> media: s2255: bound JPEG frame size before copying into the buffer Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Michael Bommarito <michael.bommarito(a)gmail.com> media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow Michael Bommarito <michael.bommarito(a)gmail.com> media: rkvdec: hevc: tighten EXT SPS RPS control dimensions Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: rkvdec: Propagate platform_get_irq() errors Sven Püschel <s.pueschel(a)pengutronix.de> media: rockchip: rga: don't change RGB quantization Myeonghun Pak <mhun512(a)gmail.com> media: rc: sunxi-cir: Unregister rc device on probe failure David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix scaler factor overflow for large crop sizes David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix AEXP IHIST disable bit shift David Carlier <devnexen(a)gmail.com> media: mali-c55: Fix clock leak on reset deassert failure David Carlier <devnexen(a)gmail.com> media: mali-c55: fix dropped last AEC histogram zone weight Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Correct color map between V4L2 and ISI Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Johan Hovold <johan(a)kernel.org> media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Guangshuo Li <lgs201920130244(a)gmail.com> media: platform: mtk-mdp3: Fix SCP device refcounting Christian Hewitt <christianshewitt(a)gmail.com> media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder José María Martín <jmmartinf(a)hotmail.com> media: ipu-bridge: check all DMI entries when overriding sensor rotation Cong Nguyen <congnt264(a)gmail.com> media: intel/ipu6: fix async notifier cleanup leak on parse error Dave Stevenson <dave.stevenson(a)raspberrypi.com> media: imx355: Avoid calling imx355_power_off twice in error path Benjamin Mugnier <benjamin.mugnier(a)foss.st.com> media: i2c: vd55g1: Fix media bus code initialization Benjamin Mugnier <benjamin.mugnier(a)foss.st.com> media: i2c: vd55g1: Fix manual digital gain on color variant Richard Leitner <richard.leitner(a)linux.dev> media: i2c: ov9282: restore flash duration calculation Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov7740: fix use-after-destroy in remove Biren Pandya <birenpandya(a)gmail.com> media: i2c: ov02a10: fix endpoint parsing use-after-free Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Return test pattern write errors Narasimharao Vadlamudi <ahmisaranrao(a)gmail.com> media: i2c: imx415: Release runtime PM reference on VBLANK error Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: go7007: defer the ALSA v4l2 put until card release Jiangong.Han <jiangong.han(a)windriver.com> media: em28xx: fix use-after-free of dev_next->devlist on disconnect Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> media: em28xx: defer audio-only extension registration Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP Fan Wu <fanwu01(a)zju.edu.cn> media: cx23885: cancel NetUP CI work before teardown Bryam Vargas <hexlabsecurity(a)proton.me> media: cx231xx: reject geometry changes while the VBI queue is busy Ruoyu Wang <ruoyuw560(a)gmail.com> media: cobalt: Avoid freeing ALSA private data twice Dawei Feng <dawei.feng(a)seu.edu.cn> media: cedrus: fix memory leak in cedrus_init_ctrls() Ruoyu Wang <ruoyuw560(a)gmail.com> media: cec: Serialize exclusive follower delivery Yi Ding <yi.s.ding(a)gmail.com> media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Hans Verkuil <hverkuil+cisco(a)kernel.org> media: cec: extron-da-hd-4k-plus: add sanity check Biren Pandya <birenpandya(a)gmail.com> media: cec: disable delayed work before freeing an interrupted transmit Jonas Karlman <jonas(a)kwiboo.se> media: cec: core: Fix kmemleak due to missed rc_free_device() call Eugen Hristev <ehristev(a)kernel.org> media: bcm2835-unicam: Fix pipeline wrong validation for unpacked formats Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Remove obsolete frame_count check in venc_start_session Valery Borovsky <vebohr(a)gmail.com> media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Danilo Krummrich <dakr(a)kernel.org> rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> LoongArch: Avoid preempt count underflow without probe Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Do not save/restore percpu base register in rethook trampoline Nathan Chancellor <nathan(a)kernel.org> LoongArch: Do not select HAVE_RUST when KASAN is enabled Bibo Mao <maobibo(a)loongson.cn> LoongArch: Fix acpi_package_ids[] array overflow Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Fix off-by-one error for insn_is_cast_user() Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Move arena register slot below TCC context Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Expand module virtual address space to 2GB Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Refactor jump offset calculation in tail call Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: BPF: Optimize redundant TCC loads in epilogue Han Gao <gaohan(a)iscas.ac.cn> LoongArch: Add DIRECT_MAP_PHYSMEM_END definition Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Validate MSI data before routing it to EIOINTC Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Free init resources if kvm_init() fails Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix TOCTOU race on pv_features Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path Chaithanya Lagisetty <nagachaithanya9911(a)gmail.com> LoongArch: KVM: Add unregister helpers for the KVM interrupt devices Zeng Chi <zengchi(a)kylinos.cn> LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly cap TLBI Range to the architural limit Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Fuad Tabba <fuad.tabba(a)linux.dev> KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure Kajetan Puchalski <kajetan.puchalski(a)arm.com> KVM: arm64: vgic: Fix detection of MI on no pending LR Qihang <q.h.hack.winter(a)gmail.com> KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables Marc Zyngier <maz(a)kernel.org> KVM: arm64: Sign-extend VA for range-based TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Remove VM-wide VNCR mapping counter Marc Zyngier <maz(a)kernel.org> KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping Marc Zyngier <maz(a)kernel.org> KVM: arm64: Correctly handle end of VA space TLBI invalidation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Marc Zyngier <maz(a)kernel.org> KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Restore sigset on error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: keyop: use mmu_lock to read gmap->asce Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory corruption by not reinjecting CK machine checks Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize irq in reinject_machine_check Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Zero initialize data structures for inject_pfault_token Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Take srcu when importing watchpoint data Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Free guest debug data on vcpu destroy Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix old_data leak in guest debug error path Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix memory leak in guest debug handling Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: Fix length check __import_wp_info() Yosry Ahmed <yosry(a)kernel.org> KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Sean Christopherson <seanjc(a)google.com> KVM: x86: Serialize writes to disabled_quirks using kvm->lock Carlos López <clopez(a)suse.de> KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU Yosry Ahmed <yosry(a)kernel.org> KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed <yosry(a)kernel.org> KVM: nVMX: Always flush vpid02 on first use Amit Machhiwal <amachhiw(a)linux.ibm.com> KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Reject integration times with a non-zero seconds part Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Nikhil Gautam <nikhilgtr(a)gmail.com> iio: light: opt4001: Fix power down clearing bits of the wrong register Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Fix incorrect register name in threshold read error message Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: opt4060: Reject integration times with a non-zero seconds part Paul Geurts <paul.geurts(a)prodrive-technologies.com> iio: ti-ads7138: Disable STATS_EN bit while reading conversion results Sanjay Chitroda <sanjayembeddedse(a)gmail.com> iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Cong Nguyen <congnt264(a)gmail.com> iio: srf04: fix pm_runtime handling on probe error path Can Peng <pengcan(a)kylinos.cn> iio: pressure: mpl115: Fix runtime PM cleanup Rupesh Majhi <zoone.rupert(a)gmail.com> iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Vidhu Sarwal <vidhu.linux(a)gmail.com> iio: light: ltrf216a: fix runtime PM reference leak in error path Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> iio: light: gp2ap002: Disable regulators on resume failure Giorgi Tchankvetadze <giorgi(a)tchankvetadze.com> iio: light: cm32181: return zero after writing calibscale Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: light: apds9306: fix PM reference leak in apds9306_read_data() Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion Cong Nguyen <congnt264(a)gmail.com> iio: gyro: mpu3050: fix sign of raw angular velocity readings Joshua Crofts <joshua.crofts1(a)gmail.com> iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig Erick Henrique <erick.henrique.rodrigues(a)usp.br> iio: dac: m62332: Fix regulator reference count imbalance Can Peng <pengcan(a)kylinos.cn> iio: dac: ad5446: fix OF module device table Babanpreet Singh <bbnpreetsingh(a)gmail.com> iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show Linmao Li <lilinmao(a)kylinos.cn> iio: chemical: sgp30: Handle IAQ thread creation failure Fan Wu <fanwu01(a)zju.edu.cn> iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Moksh Panicker <mokshpanicker.7(a)gmail.com> iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Tie IIO dma fence lock lifetime to the fence Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Make IIO DMA fence release RCU-safe Lars-Peter Clausen <lars(a)metafoo.de> iio: buffer: Fix potential use-after-free in anonymous buffer release Cong Nguyen <congnt264(a)gmail.com> iio: adc: pac1921: fix wrong channel used in trigger handler read Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig Joshua Crofts <joshua.crofts1(a)gmail.com> iio: adc: max14001: add missing 'select REGMAP' to Kconfig Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: adi-axi-adc: add data size support for AD408X backend Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ad4080: configure backend data size Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2783-sdw: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2780: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2764: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tas2552: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sti-sas: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: sgtl5000: sort the register default table WenTao Liang <vulab(a)iscas.ac.cn> ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt721-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt715-sdca: drop duplicate reg_default entries Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt712-sdca-dmic: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt711-sdca: sort the register default tables Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt700: drop duplicate reg_default entry Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt298: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt286: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt274: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1318-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1316-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt1017-sdca-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pm4125-sdw: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: pcm512x: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: ml26124: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: max9860: sort the register default table Binbin Zhou <zhoubinbin(a)loongson.cn> ASoC: loongson: Fix error handling in ACPI property parsing Haoxiang Li <haoxiang_li2024(a)163.com> AsoC: intel: sst: fix PCI device reference leak on probe failure Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: fsl_easrc: sort the register default table wangdicheng <wangdicheng(a)kylinos.cn> ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division Haoxiang Li <haoxiang_li2024(a)163.com> ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cx2072x: sort the register default table Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l34: drain threaded IRQ before runtime suspend Runyu Xiao <runyu.xiao(a)seu.edu.cn> ASoC: cs35l33: drain threaded IRQ before runtime suspend Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: adau1761: sort the register default table Linkai Gong <gonglinkai(a)kylinos.cn> i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Heiko Stuebner <heiko.stuebner(a)cherry.de> clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk Stephan Gerhold <stephan.gerhold(a)linaro.org> clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Pedro Kopper <pedro.kopper(a)microchip.com> clk: microchip: mpfs: fix regmap_update_bits() mask/val order Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: align gxbb_32k_clk_sel number of parents with actual count Akari Tsuyukusa <akkun11.open(a)gmail.com> clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen Pavel Löbl <pavel(a)loebl.cz> clk: clocking-wizard: fix integer overflow in rate calculation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent CRC corruptions after claim flush Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: fix freeing of claims on meshif deletion Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: avoid unaligned fault in IP extraction Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: linearize skbuff for packet generation Sven Eckelmann <sven(a)narfation.org> batman-adv: mcast: ensure unshared skb for multicast packets Sven Eckelmann <sven(a)narfation.org> batman-adv: fix TX priority extraction for BATADV_FORW_MCAST Zhiling Zou <zhilinz(a)nebusec.ai> batman-adv: fix stale receive device on merged fragments Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: rawnand: validate ONFI extended parameter page sections James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: fix H6/H616 controller timings James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: describe tADL and tWHR delays James Hilliard <james.hilliard1(a)gmail.com> mtd: rawnand: sunxi: group controller delay tables Miquel Raynal (DAVE) <miquel.raynal(a)bootlin.com> mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() Xu Rao <raoxu(a)uniontech.com> mtd: mtdoops: free page bitmap when the backing MTD is removed Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: afs: validate v2 image info bounds Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix NULL deref in status_show() during queue probe Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Anthony Krowiak <akrowiak(a)linux.ibm.com> s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/crash: stop watchdogs before booting kdump kernel Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Move H_WATCHDOG definitions to a common header Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/pseries: Handle and log pseries-wdt registration failures Muchun Song <muchun.song(a)linux.dev> powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan <ruanjinjie(a)huawei.com> powerpc/kexec_file: Fix null-ptr-def in extra size calculation Helge Deller <deller(a)gmx.de> parisc: Fix alignment of asm statements in head.S Pei Xiao <xiaopei01(a)kylinos.cn> parisc: eisa: Fix infinite loop when parsing invalid IRQ value Bryam Vargas <hexlabsecurity(a)proton.me> nvdimm/btt: reject an arena whose nfree is below the lane count Narek Jilavyan <njilav(a)gmail.com> mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() Longlong Xia <xialonglong(a)kylinos.cn> mm/hugetlb: keep max_huge_pages when dissolving surplus folios Sourav Panda <souravpanda(a)google.com> mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio Wupeng Ma <mawupeng1(a)huawei.com> mm/hugetlb: fix missing migratable flag on same-node hugetlb migration Hui Su <sh_def(a)163.com> mm/migrate_device: avoid out-of-bounds writes for compound folios Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs Abel Vesa <abel.vesa(a)oss.qualcomm.com> Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza" Eric Dumazet <edumazet(a)google.com> Revert "once: don't use a work queue to reset sleepable static key" caina <caina(a)uniontech.com> Revert "irqchip/mbigen: Fix mbigen node address layout" Christian Marangi <ansuelsmth(a)gmail.com> pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: reject unsolicited H2CData PDUs Shivam Kumar <kumar.shivam43666(a)gmail.com> nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Kazuki Hanai <hnkz.64(a)gmail.com> nvmet-auth: Synchronize timeout work during SQ teardown Chao Shi <coshi036(a)gmail.com> nvme: skip the zoned limits update if the zone info query failed Tristan Madani <tristan(a)talencesecurity.com> nvme: add missing SRCU grace period in error path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: check the data direction of a C2HData PDU Niklas Cassel <cassel(a)kernel.org> nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Xu Rao <raoxu(a)uniontech.com> nvme-fabrics: fix DHCHAP secret leak on parse failure GuoHan Zhao <zhaoguohan(a)kylinos.cn> accel/ethosu: fix job completion fence cleanup GuoHan Zhao <zhaoguohan(a)kylinos.cn> accel/ethosu: check MMIO mapping errors in probe Taimuraz Kaitmazov <taimuraz(a)kaitmazov.com> accel/amdxdna: return early from a zero-length flush Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Allow splice reads on static buffers Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix race between non-atomic ops and trigger-start Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: harmony: initialize locks before requesting IRQ HyeongJun An <sammiee5311(a)gmail.com> ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Khushit Shah <khushit.shah(a)nutanix.com> arm64: errata: pass REVIDR when matching target implementation CPUs Fuad Tabba <fuad.tabba(a)linux.dev> arm64: Don't read GMID_EL1 when MTE is disabled Karl Mehltretter <kmehltretter(a)gmail.com> arm64: mm: Fix the lockless page-table walk in show_pte() Guangshuo Li <lgs201920130244(a)gmail.com> i2c: qcom-cci: fix autosuspend cleanup Ahmad Byagowi <ahmadexp(a)gmail.com> i2c: mux: Fix channel node leak on adapter add failure Vasileios Almpanis <vasilisalmpanis(a)gmail.com> i2c: core: fix debugfs UAF on adapter removal Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> i2c: qcom-geni: update frequency table to fix timing parameters Hongbo Yao <andy.xu(a)hj-micro.com> i2c: designware: Enable interrupt mask workaround for HJMC3001 Yilin Zhang <yilinzhang(a)moonshot.ai> perf: Fix use-after-free when perf mmap() revival races with the last munmap() Haiyong Sun <sunhaiyong(a)loongson.cn> perf build: Add clang and rust target flags for LoongArch Sizhe Liu <liusizhe5(a)huawei.com> perf hisi-ptt: Fix PTT trace TLP header parsing Viktor Malik <vmalik(a)redhat.com> perf trace: Refactor augmented_raw_syscalls using bpf_for Viktor Malik <vmalik(a)redhat.com> perf trace: Factor out BPF loop body Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Fix kernel address leakages in LBR stack Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt Shakeel Butt <shakeel.butt(a)linux.dev> memcg: make the v1 soft limit knob inert Shakeel Butt <shakeel.butt(a)linux.dev> memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done Shakeel Butt <shakeel.butt(a)linux.dev> memcg: keep folio's objcg same as its node Eric Dumazet <edumazet(a)google.com> mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Usama Arif <usama.arif(a)linux.dev> mm/huge_memory: transfer the pmd dirty bit to the folio on zap Baineng Shou <shoubaineng(a)gmail.com> misc: fastrpc: don't publish fd before copy_to_user() succeeds Masami Hiramatsu (Google) <mhiramat(a)kernel.org> kprobes: Protect kprobe_blacklist with RCU Ju Nan <junan76(a)163.com> irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Bradley Morgan <brads(a)mainlining.org> ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Hajo Noerenberg <hajo-linux-ide(a)noerenberg.de> ata: ahci: work around lost interrupts on Marvell 88SE61xx Max Kellermann <max.kellermann(a)ionos.com> ceph: lock mutex in ceph_mds_check_access() Hui Su <sh_def(a)163.com> bpf: Fix infinite loop in pcpu_freelist push with one possible CPU Chen Pei <cp0613(a)linux.alibaba.com> bpf, riscv: Make arena support depend on ZACAS Damien Le Moal <dlemoal(a)kernel.org> block: flag zoned disks with GENHD_FL_NO_PART Ulf Hansson <ulf.hansson(a)oss.qualcomm.com> cpuidle: psci: Fix support for probe deferral by dropping the faux device Linkai Gong <gonglinkai(a)kylinos.cn> cpuidle: dt_idle_genpd: kfree() the original name allocation Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Mark emulated IRQ as level-triggered Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Complete descriptors before pausing Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma: Fix HDMA channel status register access Martin Kaiser <martin(a)kaiser.cx> dmaengine: fsl-edma: tracing: no ptr dereference during log output Aneesh Kumar K.V (Arm) <aneesh.kumar(a)kernel.org> dma-direct: return struct page from dma_direct_alloc_from_pool() Baineng Shou <shoubaineng(a)gmail.com> dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds Mikulas Patocka <mpatocka(a)redhat.com> dm: fix resume-vs-remove race Mikulas Patocka <mpatocka(a)redhat.com> dm: fix race when loading and unloading a table Ibrahim Hashimov <security(a)auditcode.ai> HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Wei Jie Law <98lawweijie(a)gmail.com> HID: rmi: fix OOB access with undersized RMI reports Shen Yongchao <grayhat(a)foxmail.com> HID: bpf: serialize device reference release in struct_ops destroy path Steven Rostedt <rostedt(a)goodmis.org> ftrace: Synchronize the initialization of ftrace_ops Steven Rostedt <rostedt(a)goodmis.org> ftrace: Take trace_array reference before accessing its ftrace_ops Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling Yao Kai <yaokai34(a)huawei.com> futex: Prevent rcuwait use-after-free during requeue PI Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/secretmem: properly account locked pages SJ Park <sj(a)kernel.org> mm/damon/core: initialize damos->last_applied SJ Park <sj(a)kernel.org> mm/damon/core: handle region split failure in apply_min_nr_regions() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong region walk in commit_target_regions() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: handle region split failure in filter_out() SJ Park <sj(a)kernel.org> mm/damon/core-kunit: check region count before testing in split_at() SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs: kobject_del() region and target (error) dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme region dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme filter dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme dirs SJ Park <sj(a)kernel.org> mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs SJ Park <sj(a)kernel.org> samples/damon/wsse: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/wsse: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/prcl: stop and free damon ctx when damon_call() fails SJ Park <sj(a)kernel.org> samples/damon/prcl: handle damon_start() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_stop() failure SJ Park <sj(a)kernel.org> samples/damon/mtier: handle damon_start() failure SJ Park <sj(a)kernel.org> mm/damon/vaddr-kunit: check region count in three_regions test SJ Park <sj(a)kernel.org> mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs() SJ Park <sj(a)kernel.org> mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() Song Hu <husong(a)kylinos.cn> Docs/ABI/damon: fix typo in intervals_goal sysfs path Runyu Xiao <runyu.xiao(a)seu.edu.cn> scsi: pm8001: Use rollback index when freeing MSI-X vectors Thomas Lamprecht <t.lamprecht(a)proxmox.com> scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame Rahul Chandelkar <rc(a)rexion.ai> scsi: bsg: Fix TOCTOU in io_uring passthrough command setup Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: bsg: Cap io_uring sense copy to max_response_len Sujal Tuladhar <sujaltuladhar1231(a)gmail.com> scsi: target: iscsi: Reserve a terminator byte for the login payload Honghui Jiang <jiang_hh2019(a)163.com> spi: Fix DMA mapping ownership on partial map failure Can Peng <pengcan(a)kylinos.cn> spi: bcmbca-hsspi: disable clocks on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx: disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> spi: bcm63xx-hsspi: disable clocks on resume failure Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size Paul Louvel <paul.louvel(a)bootlin.com> soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler Kanishka De Silva <kpskanna1915(a)gmail.com> ublk: clear VM_MAYWRITE on read-only ublk char device mmap Bryan Lim <foxieflakey(a)gmail.com> userfaultfd: reset err to be 0 when move_pages_ptes succeeded Steven Rostedt <rostedt(a)goodmis.org> tracing: Take trace_array reference when opening options file Steven Rostedt <rostedt(a)goodmis.org> tracing: Have show_event_filters/triggers files take trace array ref Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member Can Peng <pengcan(a)kylinos.cn> thermal/drivers/qoriq: Disable clock on resume failure Can Peng <pengcan(a)kylinos.cn> thermal/drivers/imx: Disable clock on runtime resume failure Arthur Gautier <baloo(a)superbaloo.net> xhci: fix lost bounce buffers on TDs spanning several ring segments Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: fix null pointer dereference in usb_put_function_instance() Lovekesh Solanki <lovekeshsolanki00(a)gmail.com> USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_midi: initialize work in f_midi_alloc() Ivy Lopez <skunkolee(a)gmail.com> usb: gadget: f_midi2: fix use-after-free in string attribute show path Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Aleksandr Nogikh <nogikh(a)google.com> usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Jameson Thies <jthies(a)google.com> usb: typec: ucsi: displayport: Fix OOB altmode array index Sven Peter <sven(a)kernel.org> usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic: cancel reset_work on stop Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Marek Vasut <marex(a)nabladev.com> usb: typec: mux: Fix typec_switch_match() Marek Vasut <marex(a)nabladev.com> usb: typec: mux: avoid duplicated mux switches Chang Wu <kunjinkao.jp(a)gmail.com> usb: typec: hd3ss3220: track VBUS enable state per consumer Myeonghun Pak <mhun512(a)gmail.com> usb: storage: realtek_cr: fix use-after-free on disconnect Elson Serrao <elson.serrao(a)oss.qualcomm.com> usb: dwc3: clear forceRM when issuing EndTransfer Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix wakeup from S3 after controller context loss Liu Qi <liuqi(a)longcheer.com> usb-storage: ene_ub6250: fix race between scan work and probe Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> media: usbtv: keep device alive while ALSA card exists Stephan Gerhold <stephan(a)gerhold.net> clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset HyeongJun An <sammiee5311(a)gmail.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: image: mdc800: change kmalloc() to kzalloc() Hari Mishal <harimishal1(a)gmail.com> drm/amd/display: fix division by zero in get_estimated_bw() Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during blocked-lock reaping Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during close_lru reaping Chuck Lever <cel(a)kernel.org> NFSD: Consolidate the revocation-path client unpin Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during export state revocation Chuck Lever <cel(a)kernel.org> NFSD: Guard admin state-revocation walks with NFSD_NET_UP Chuck Lever <cel(a)kernel.org> NFSD: Annotate caller preconditions for the state-table walkers Sean Christopherson <seanjc(a)google.com> KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Rong Zhang <i(a)rong.moe> ACPI: battery: Protect all properties with a separated mutex Rong Zhang <i(a)rong.moe> ACPI: battery: Use kstrtoul() over sscanf("%lu\n") Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: clean up device list on probe failure Rosalie Wanders <rosalie(a)mailbox.org> HID: sony: use guard() and scoped_guard() Sam Edwards <cfsworks(a)gmail.com> ceph: properly decrypt filenames in vmalloc() buffers David Carlier <devnexen(a)gmail.com> zram: fix slot lock bit position on big-endian 64-bit Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> zram: move lockmap to be per-zram instead per table Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Fix Use-After-Free in AIO error path Gabriel Prostitis <prostitisgabriel(a)gmail.com> USB: gadget: ffs: fix mm lifetime handling Brendan Jackman <brendan.jackman(a)linux.dev> mm/page_alloc: don't spin_trylock() in NMI on UP Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM HE WEI（ギカク） <skyexpoc(a)gmail.com> fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() ------------- Diffstat: Documentation/ABI/testing/sysfs-kernel-mm-damon | 8 +- Documentation/admin-guide/cgroup-v1/memory.rst | 49 +---- .../devicetree/bindings/media/nxp,imx8-isi.yaml | 4 +- Documentation/trace/hisi-ptt.rst | 28 +-- .../media/v4l/ext-ctrls-colorimetry.rst | 12 +- Makefile | 4 +- arch/arm64/include/asm/cpu.h | 1 + arch/arm64/include/asm/cpufeature.h | 7 - arch/arm64/include/asm/kvm_host.h | 3 - arch/arm64/include/asm/kvm_nested.h | 20 ++ arch/arm64/kernel/cpu_errata.c | 2 +- arch/arm64/kernel/cpufeature.c | 33 +++- arch/arm64/kernel/cpuinfo.c | 2 +- arch/arm64/kvm/at.c | 2 - arch/arm64/kvm/hyp/vhe/switch.c | 3 +- arch/arm64/kvm/nested.c | 139 +++++++++----- arch/arm64/kvm/sys_regs.c | 11 ++ arch/arm64/kvm/vgic/vgic-init.c | 1 + arch/arm64/kvm/vgic/vgic-its.c | 8 + arch/arm64/kvm/vgic/vgic-v3-nested.c | 2 +- arch/arm64/kvm/vgic/vgic-v3.c | 12 +- arch/arm64/mm/fault.c | 12 +- arch/loongarch/Kconfig | 2 +- arch/loongarch/include/asm/kvm_dmsintc.h | 1 + arch/loongarch/include/asm/kvm_eiointc.h | 1 + arch/loongarch/include/asm/kvm_host.h | 1 + arch/loongarch/include/asm/kvm_ipi.h | 1 + arch/loongarch/include/asm/kvm_pch_pic.h | 1 + arch/loongarch/include/asm/pgtable.h | 9 +- arch/loongarch/kernel/acpi.c | 3 +- arch/loongarch/kernel/kprobes.c | 3 + arch/loongarch/kernel/rethook_trampoline.S | 2 - arch/loongarch/kvm/exit.c | 1 - arch/loongarch/kvm/intc/dmsintc.c | 8 +- arch/loongarch/kvm/intc/eiointc.c | 5 + arch/loongarch/kvm/intc/ipi.c | 5 + arch/loongarch/kvm/intc/pch_pic.c | 8 + arch/loongarch/kvm/main.c | 39 +++- arch/loongarch/kvm/mmu.c | 10 + arch/loongarch/kvm/vcpu.c | 8 +- arch/loongarch/kvm/vm.c | 1 + arch/loongarch/mm/init.c | 17 +- arch/loongarch/net/bpf_jit.c | 40 ++-- arch/parisc/kernel/head.S | 1 + arch/powerpc/include/asm/papr-watchdog.h | 64 +++++++ arch/powerpc/include/asm/reg.h | 12 ++ arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/kexec/ranges.c | 12 +- arch/powerpc/kvm/book3s_hv.c | 15 +- arch/powerpc/kvm/powerpc.c | 6 + arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +- arch/powerpc/platforms/pseries/setup.c | 28 ++- arch/riscv/net/bpf_jit_comp64.c | 10 +- arch/s390/include/asm/nmi.h | 3 + arch/s390/kernel/nmi.c | 5 +- arch/s390/kvm/guestdbg.c | 9 +- arch/s390/kvm/interrupt.c | 26 +-- arch/s390/kvm/kvm-s390.c | 22 ++- arch/x86/events/intel/core.c | 10 +- arch/x86/events/intel/lbr.c | 12 +- arch/x86/events/perf_event.h | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 4 + arch/x86/include/asm/kvm_host.h | 6 + arch/x86/kvm/hyperv.c | 25 ++- arch/x86/kvm/mmu/mmu.c | 107 ++++++----- arch/x86/kvm/mmu/tdp_iter.h | 7 + arch/x86/kvm/mmu/tdp_mmu.c | 20 +- arch/x86/kvm/svm/sev.c | 80 ++++++-- arch/x86/kvm/svm/svm.c | 6 +- arch/x86/kvm/svm/svm.h | 2 + arch/x86/kvm/vmx/nested.c | 75 ++++---- arch/x86/kvm/x86.c | 17 +- arch/x86/kvm/x86.h | 2 +- block/genhd.c | 7 + drivers/accel/amdxdna/amdxdna_gem.c | 3 + drivers/accel/ethosu/ethosu_drv.c | 2 + drivers/accel/ethosu/ethosu_job.c | 10 +- drivers/acpi/battery.c | 155 +++++++++++----- drivers/ata/ahci.c | 49 +++++ drivers/block/ublk_drv.c | 6 + drivers/block/zram/zram_drv.c | 27 ++- drivers/block/zram/zram_drv.h | 16 +- drivers/clk/mediatek/Kconfig | 1 + drivers/clk/meson/gxbb.c | 2 +- drivers/clk/microchip/clk-mpfs.c | 2 +- drivers/clk/qcom/gcc-mdm9607.c | 182 +----------------- drivers/clk/qcom/gcc-msm8916.c | 5 +- drivers/clk/qcom/gcc-msm8939.c | 5 +- drivers/clk/rockchip/clk-rk3588.c | 2 +- drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 4 +- drivers/cpuidle/cpuidle-psci.c | 42 ++--- drivers/cpuidle/dt_idle_genpd.c | 3 +- drivers/dma-buf/dma-buf.c | 20 ++ drivers/dma-buf/dma-heap.c | 80 ++++---- drivers/dma/dw-edma/dw-edma-core.c | 24 ++- drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +- drivers/dma/fsl-edma-trace.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 59 +++++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 23 ++- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 56 ++++-- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 13 ++ .../dml21/src/dml2_core/dml2_core_shared_types.h | 4 +- .../display/dc/dml2_0/dml2_translation_helper.c | 1 + drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- .../display/dc/link/protocols/link_dp_dpia_bw.c | 5 + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 + drivers/gpu/drm/drm_drv.c | 34 +++- drivers/gpu/drm/drm_pagemap.c | 128 ++++++++++--- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 ++---- drivers/gpu/drm/i915/display/intel_cursor.c | 15 +- drivers/gpu/drm/i915/display/skl_universal_plane.c | 15 +- drivers/gpu/drm/i915/i915_pci.c | 3 + drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++ drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 18 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 13 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c | 191 +++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 17 ++ drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 86 ++++++++- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 129 ++++++------- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/disp.c | 64 +++++++ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 9 + .../nouveau/nvkm/subdev/gsp/rm/r570/nvrm/disp.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 5 + drivers/gpu/drm/panel/panel-edp.c | 19 +- drivers/gpu/drm/panthor/panthor_fw.c | 22 ++- drivers/gpu/drm/solomon/ssd130x.c | 9 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/gpu/drm/sysfb/ofdrm.c | 8 +- drivers/gpu/drm/sysfb/simpledrm.c | 74 ++++++-- drivers/gpu/drm/ttm/ttm_pool.c | 15 +- drivers/gpu/drm/xe/xe_vram.c | 26 ++- drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +- drivers/hid/hid-rmi.c | 46 ++++- drivers/hid/hid-sony.c | 87 ++++----- drivers/hid/wacom_wac.c | 13 ++ drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- drivers/i2c/busses/i2c-qcom-cci.c | 11 +- drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/i2c-core-base.c | 6 + drivers/i2c/i2c-mux.c | 1 + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + drivers/iio/adc/Kconfig | 2 + drivers/iio/adc/ad4080.c | 5 + drivers/iio/adc/adi-axi-adc.c | 30 +++ drivers/iio/adc/pac1921.c | 2 +- drivers/iio/adc/ti-ads7138.c | 42 ++++- drivers/iio/chemical/atlas-sensor.c | 19 +- drivers/iio/chemical/sgp30.c | 3 + drivers/iio/dac/Kconfig | 1 + drivers/iio/dac/ad3552r-hs.c | 2 +- drivers/iio/dac/ad5446-i2c.c | 2 +- drivers/iio/dac/m62332.c | 17 +- drivers/iio/gyro/mpu3050-core.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_fusion.c | 5 + drivers/iio/industrialio-buffer.c | 38 ++-- drivers/iio/light/apds9306.c | 8 +- drivers/iio/light/cm32181.c | 2 +- drivers/iio/light/gp2ap002.c | 10 +- drivers/iio/light/ltrf216a.c | 3 +- drivers/iio/light/opt4001.c | 37 ++-- drivers/iio/light/opt4060.c | 5 +- drivers/iio/pressure/dps310.c | 3 +- drivers/iio/pressure/mpl115.c | 11 +- drivers/iio/proximity/srf04.c | 1 + drivers/iio/temperature/hid-sensor-temperature.c | 3 +- drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-stm32mp-exti.c | 4 +- drivers/md/dm.c | 14 +- drivers/media/cec/core/cec-adap.c | 10 +- drivers/media/cec/core/cec-core.c | 2 - drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 + .../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 23 ++- drivers/media/i2c/alvium-csi2.c | 2 +- drivers/media/i2c/imx355.c | 3 +- drivers/media/i2c/imx415.c | 4 +- drivers/media/i2c/ov02a10.c | 12 +- drivers/media/i2c/ov7740.c | 4 +- drivers/media/i2c/ov9282.c | 3 +- drivers/media/i2c/vd55g1.c | 32 +++- drivers/media/i2c/video-i2c.c | 8 +- drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 - drivers/media/pci/cx23885/cimax2.c | 1 + drivers/media/pci/intel/ipu-bridge.c | 8 +- drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 + drivers/media/pci/saa7164/saa7164-core.c | 8 +- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/venc.c | 2 - .../media/platform/arm/mali-c55/mali-c55-core.c | 2 + .../media/platform/arm/mali-c55/mali-c55-params.c | 1 + .../platform/arm/mali-c55/mali-c55-registers.h | 2 +- .../media/platform/arm/mali-c55/mali-c55-resizer.c | 2 +- drivers/media/platform/broadcom/bcm2835-unicam.c | 3 +- .../platform/chips-media/wave5/wave5-vpu-dec.c | 64 +++++-- .../platform/chips-media/wave5/wave5-vpu-enc.c | 6 +- .../platform/chips-media/wave5/wave5-vpuconfig.h | 2 +- .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 6 +- .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 6 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/qcom/iris/iris_ctrls.c | 2 +- drivers/media/platform/qcom/iris/iris_hfi_gen1.c | 16 +- .../platform/qcom/iris/iris_platform_common.h | 1 - drivers/media/platform/qcom/iris/iris_state.c | 2 +- drivers/media/platform/qcom/iris/iris_vidc.c | 11 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 9 +- .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 5 + drivers/media/platform/rockchip/rga/rga3-hw.c | 12 +- .../platform/rockchip/rkvdec/rkvdec-hevc-common.c | 3 + drivers/media/platform/rockchip/rkvdec/rkvdec.c | 8 +- drivers/media/platform/ti/vpe/vip.c | 37 +++- drivers/media/rc/sunxi-cir.c | 9 +- drivers/media/test-drivers/vimc/vimc-capture.c | 4 +- drivers/media/tuners/tda18250.c | 4 +- drivers/media/usb/airspy/airspy.c | 19 +- drivers/media/usb/cx231xx/cx231xx-video.c | 4 +- drivers/media/usb/em28xx/em28xx-cards.c | 3 +- drivers/media/usb/em28xx/em28xx-core.c | 2 + drivers/media/usb/go7007/snd-go7007.c | 10 +- drivers/media/usb/s2255/s2255drv.c | 11 ++ drivers/media/usb/usbtv/usbtv-audio.c | 11 ++ drivers/media/v4l2-core/v4l2-async.c | 1 - drivers/media/v4l2-core/v4l2-ctrls-core.c | 64 +++++-- drivers/media/v4l2-core/v4l2-fwnode.c | 2 + drivers/misc/fastrpc.c | 16 +- drivers/mtd/mtdoops.c | 3 + drivers/mtd/nand/ecc-realtek.c | 1 + drivers/mtd/nand/raw/nand_onfi.c | 27 ++- drivers/mtd/nand/raw/pl35x-nand-controller.c | 5 +- drivers/mtd/nand/raw/sunxi_nand.c | 113 +++++++++--- drivers/mtd/parsers/afs.c | 7 + drivers/nvdimm/btt.c | 8 + drivers/nvme/host/core.c | 24 ++- drivers/nvme/host/fabrics.c | 2 + drivers/nvme/host/fc.c | 26 ++- drivers/nvme/host/tcp.c | 7 + drivers/nvme/target/auth.c | 6 + drivers/nvme/target/core.c | 2 +- drivers/nvme/target/nvmet.h | 2 + drivers/nvme/target/tcp.c | 10 + drivers/parisc/eisa.c | 5 + drivers/pci/hotplug/pnv_php.c | 2 +- drivers/pci/hotplug/rpaphp_slot.c | 2 +- drivers/pci/pci.c | 5 +- drivers/pci/slot.c | 50 +++-- drivers/pmdomain/mediatek/Kconfig | 5 +- drivers/pmdomain/qcom/rpmhpd.c | 4 - drivers/power/supply/ab8500_fg.c | 32 ++-- drivers/remoteproc/qcom_q6v5_pas.c | 13 +- drivers/rtc/rtc-rzn1.c | 30 ++- drivers/s390/crypto/vfio_ap_ops.c | 203 ++++++++++++++------- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +- drivers/scsi/pm8001/pm8001_init.c | 4 +- drivers/scsi/qla2xxx/qla_attr.c | 6 +- drivers/scsi/qla2xxx/qla_bsg.c | 46 +++-- drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_dfs.c | 4 +- drivers/scsi/qla2xxx/qla_edif.c | 3 + drivers/scsi/qla2xxx/qla_gs.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 61 ++++++- drivers/scsi/qla2xxx/qla_inline.h | 13 ++ drivers/scsi/qla2xxx/qla_isr.c | 39 +++- drivers/scsi/qla2xxx/qla_mbx.c | 28 ++- drivers/scsi/qla2xxx/qla_nvme.c | 31 +++- drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/scsi_bsg.c | 47 +++-- drivers/soc/fsl/qe/qe_ports_ic.c | 7 + drivers/soc/qcom/qcom-geni-se.c | 24 +-- drivers/spi/spi-bcm63xx-hsspi.c | 8 +- drivers/spi/spi-bcm63xx.c | 6 +- drivers/spi/spi-bcmbca-hsspi.c | 8 +- drivers/spi/spi.c | 34 ++-- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 + drivers/staging/rtl8723bs/core/rtw_mlme.c | 3 + drivers/target/iscsi/iscsi_target_login.c | 2 +- drivers/thermal/imx_thermal.c | 9 +- drivers/thermal/qoriq_thermal.c | 13 +- drivers/usb/cdns3/cdnsp-gadget.c | 111 ++++++++++- drivers/usb/cdns3/cdnsp-gadget.h | 1 + drivers/usb/cdns3/cdnsp-mem.c | 98 ++++------ drivers/usb/dwc3/dwc3-google.c | 1 + drivers/usb/dwc3/ep0.c | 2 +- drivers/usb/dwc3/gadget.c | 21 ++- drivers/usb/gadget/function/f_fs.c | 31 +++- drivers/usb/gadget/function/f_mass_storage.c | 5 +- drivers/usb/gadget/function/f_midi.c | 2 +- drivers/usb/gadget/function/f_midi2.c | 17 +- drivers/usb/gadget/functions.c | 2 +- drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/host/xhci-ring.c | 32 +++- drivers/usb/image/mdc800.c | 4 +- drivers/usb/storage/ene_ub6250.c | 2 + drivers/usb/storage/realtek_cr.c | 9 +- drivers/usb/typec/hd3ss3220.c | 9 +- drivers/usb/typec/mux.c | 21 ++- .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 28 ++- drivers/usb/typec/tipd/core.c | 17 +- drivers/usb/typec/tipd/tps6598x.h | 4 +- drivers/usb/typec/ucsi/displayport.c | 2 +- drivers/watchdog/pseries-wdt.c | 53 +----- fs/ceph/crypto.c | 50 +++-- fs/ceph/mds_client.c | 12 +- fs/ceph/mds_client.h | 1 + fs/f2fs/data.c | 8 +- fs/f2fs/debug.c | 4 - fs/f2fs/dir.c | 7 +- fs/f2fs/f2fs.h | 29 ++- fs/f2fs/file.c | 170 +++++++++++++---- fs/f2fs/gc.c | 38 ++-- fs/f2fs/gc.h | 27 +-- fs/f2fs/inline.c | 2 +- fs/f2fs/iostat.c | 6 + fs/f2fs/namei.c | 17 +- fs/f2fs/node.c | 10 +- fs/f2fs/recovery.c | 41 +++-- fs/f2fs/segment.c | 18 +- fs/f2fs/super.c | 4 +- fs/f2fs/sysfs.c | 30 +-- fs/f2fs/xattr.c | 2 +- fs/nfsd/nfs4proc.c | 5 + fs/nfsd/nfs4state.c | 118 ++++++++---- fs/nfsd/nfsctl.c | 6 +- fs/ntfs3/frecord.c | 20 +- fs/smb/server/oplock.c | 79 ++++++-- include/linux/dma-buf.h | 1 + include/linux/ftrace.h | 5 +- include/linux/kprobes.h | 1 + include/linux/kvm_host.h | 1 + include/linux/pci.h | 8 +- include/linux/sched/rt.h | 2 + include/linux/sched/user.h | 3 +- include/linux/soc/qcom/geni-se.h | 4 + include/trace/events/f2fs.h | 20 +- kernel/bpf/percpu_freelist.c | 35 +++- kernel/bpf/percpu_freelist.h | 1 + kernel/bpf/stackmap.c | 173 ++++++++++++------ kernel/dma/direct.c | 18 +- kernel/events/core.c | 20 +- kernel/futex/pi.c | 16 +- kernel/futex/requeue.c | 12 +- kernel/kprobes.c | 14 +- kernel/locking/rtmutex_api.c | 2 + kernel/sched/core.c | 16 ++ kernel/trace/ftrace.c | 70 ++++--- kernel/trace/ring_buffer.c | 11 +- kernel/trace/trace.c | 67 ++++++- kernel/trace/trace.h | 5 +- kernel/trace/trace_btf.c | 12 +- kernel/trace/trace_events.c | 28 ++- kernel/trace/trace_functions.c | 2 +- kernel/trace/trace_stack.c | 2 +- lib/once.c | 2 +- mm/damon/core.c | 27 ++- mm/damon/ops-common.c | 5 +- mm/damon/paddr.c | 20 +- mm/damon/sysfs-schemes.c | 18 +- mm/damon/sysfs.c | 29 ++- mm/damon/tests/core-kunit.h | 33 +++- mm/damon/tests/vaddr-kunit.h | 5 + mm/damon/vaddr.c | 34 +--- mm/huge_memory.c | 2 + mm/hugetlb.c | 20 +- mm/hugetlb_cgroup.c | 7 +- mm/hugetlb_cma.c | 21 ++- mm/khugepaged.c | 6 - mm/madvise.c | 8 + mm/memcontrol-v1.c | 43 +++-- mm/memcontrol.c | 113 ++++++++++-- mm/mempolicy.c | 2 +- mm/migrate_device.c | 18 ++ mm/page_alloc.c | 6 +- mm/secretmem.c | 116 +++++++++++- mm/userfaultfd.c | 4 +- net/batman-adv/bridge_loop_avoidance.c | 15 +- net/batman-adv/distributed-arp-table.c | 8 +- net/batman-adv/main.c | 4 + net/batman-adv/mesh-interface.c | 7 +- net/batman-adv/multicast_forw.c | 7 +- net/core/skbuff.c | 5 +- net/sunrpc/xprtrdma/ib_client.c | 26 ++- rust/kernel/drm/ioctl.rs | 6 + samples/damon/mtier.c | 14 +- samples/damon/prcl.c | 11 +- samples/damon/wsse.c | 11 +- security/integrity/ima/ima_appraise.c | 2 + sound/core/pcm_native.c | 2 + sound/core/rawmidi.c | 2 +- sound/parisc/harmony.c | 6 +- sound/soc/codecs/adau1761.c | 34 ++-- sound/soc/codecs/cs35l33.c | 14 +- sound/soc/codecs/cs35l34.c | 14 +- sound/soc/codecs/cx2072x.c | 134 +++++++------- sound/soc/codecs/hdac_hda.c | 4 +- sound/soc/codecs/max9860.c | 2 +- sound/soc/codecs/ml26124.c | 4 +- sound/soc/codecs/pcm512x.c | 40 ++-- sound/soc/codecs/pm4125-sdw.c | 2 +- sound/soc/codecs/rt1017-sdca-sdw.h | 10 +- sound/soc/codecs/rt1316-sdw.c | 2 +- sound/soc/codecs/rt1318-sdw.c | 2 +- sound/soc/codecs/rt1318.c | 4 +- sound/soc/codecs/rt274.c | 8 +- sound/soc/codecs/rt286.c | 14 +- sound/soc/codecs/rt298.c | 14 +- sound/soc/codecs/rt700-sdw.h | 11 +- sound/soc/codecs/rt711-sdca-sdw.h | 6 +- sound/soc/codecs/rt711-sdw.h | 10 +- sound/soc/codecs/rt712-sdca-dmic.h | 6 +- sound/soc/codecs/rt712-sdca-sdw.h | 11 +- sound/soc/codecs/rt715-sdca-sdw.h | 48 +++-- sound/soc/codecs/rt715-sdw.h | 32 ++-- sound/soc/codecs/rt721-sdca-sdw.h | 44 ++--- sound/soc/codecs/sgtl5000.c | 2 +- sound/soc/codecs/sti-sas.c | 2 +- sound/soc/codecs/tas2552.c | 14 +- sound/soc/codecs/tas2764.c | 2 +- sound/soc/codecs/tas2780.c | 2 +- sound/soc/codecs/tas2783-sdw.c | 177 +++++++++--------- sound/soc/fsl/fsl_easrc.c | 8 +- sound/soc/fsl/mpc5200_psc_i2s.c | 1 + sound/soc/intel/atom/sst/sst_pci.c | 4 +- sound/soc/loongson/loongson_card.c | 6 +- sound/soc/samsung/aries_wm8994.c | 1 + sound/usb/midi.c | 2 + tools/perf/Makefile.config | 2 + .../util/bpf_skel/augmented_raw_syscalls.bpf.c | 155 ++++++++++------ .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 ++--- .../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 ++ tools/testing/selftests/mm/memfd_secret.c | 30 +-- virt/kvm/guest_memfd.c | 4 + 461 files changed, 5681 insertions(+), 2746 deletions(-)

2 months

Leads for Integrated Systems Europe Exhibitors

by Rachel Bailey

Hi team, I noticed your company was part of the Integrated Systems Europe (ISE) ecosystem. We help exhibitors connect with targeted decision-makers before, during, and after events. We provide verified B2B contact databases tailored for the professional AV, systems integration, digital signage, broadcast, smart building, unified communications, education technology, lighting, live events, and IT/networking sectors, helping companies improve outbound campaigns, generate qualified leads, and build partnerships. Verified B2B decision-maker database, including: AV & Systems Integration Professionals Digital Signage & DOOH Decision-Makers Broadcast & Content Production Professionals Smart Building & Workplace Technology Leaders Unified Communications & Collaboration Professionals IT & Networking Decision-Makers Live Events & Venue Professionals Retail, Hospitality & Corporate Technology Buyers Education Technology & Campus Technology Professionals, and more. Would this be of interest to you? If so, let me know your target audience and geography, and I'll share samples, available counts, and coverage details. Looking forward to hearing from you. Best Regards, Rachel Bailey | Sr. Demand Generation Reply “opt-out” to stop.

2 months

[PATCH 7.2 000/713] 7.2.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.4 release. There are 713 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.4-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Do not combine resources that overlap completely Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Yuhang.chen <yhchen312(a)gmail.com> wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Breno Leitao <leitao(a)debian.org> mm/kmemleak: report RCU-tasks quiescent states during the scan Breno Leitao <leitao(a)debian.org> mm/kmemleak: stop the task stack scan early when interrupted Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - avoid stale fallback key after set_secret failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - clean up and improve ECDH comments Vinicius Costa Gomes <vinicius.gomes(a)intel.com> crypto: iaa - unmap dst before software fallback on decompress Xiang Mei <xmei5(a)asu.edu> fuse: copy request headers via a stack buffer for io-uring Joanne Koong <joannelkoong(a)gmail.com> fuse: decouple fuse_ring creation from ent registration Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Perform Dynamic Address Assignment on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Restore STDBR and EXTBR registers on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reset the controller on resume Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Follow the reset deassert order used in probe Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Adrian Hunter <adrian.hunter(a)intel.com> i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Eliot Courtney <ecourtney(a)nvidia.com> rust: num: reject Bounded::shr overshifts at build time Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Ajrat Makhmutov <rauty(a)altlinux.org> ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: FCP: do not copy out an uninitialised init response Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Ali Ahmet Memis <ali(a)iusegentoo.com> mfd: qnap-mcu: keep the reply buffer alive past a command timeout Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Glenn Judd <gmj(a)meta.com> net/mlx5e: do not HW-GRO coalesce small frames Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: mctp: hold a reference to the route device in mctp_route_lookup() Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Joe Damato <joe(a)dama.to> net: bnxt: ring the doorbell when SW USO exits early Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Hui Su <sh_def(a)163.com> io_uring/waitid: avoid siginfo copy during ring teardown Hui Su <sh_def(a)163.com> io_uring/waitid: honor task_work cancellation Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Hilgad Montelo <hilgad.montelo(a)gmail.com> platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Abdun Nihaal <nihaal(a)cse.iitm.ac.in> platform/x86: int1092: Fix potential memory leak in sar_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate max level for set feature Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Shuai Xue <xueshuai(a)linux.alibaba.com> iommupt: Return zero for invalid iova_to_phys() ranges Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Robin Murphy <robin.murphy(a)arm.com> iommu/arm-smmu-v3: Add HAFT support for SVA Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ali Tariq <alitariq45892(a)gmail.com> PCI: starfive: Fix resource leaks on error paths in host_init() Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Karl Mehltretter <kmehltretter(a)gmail.com> s390/percpu: Fix MVIY_PERCPU() with older binutils Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Xu Rao <raoxu(a)uniontech.com> power: supply: pf1550: enable charging when battery profile exists Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Oscar Ou <oscarou(a)synology.com> lockd: fix swapped arguments in nlmsvc_match_ip() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Olga Kornievskaia <okorniev(a)redhat.com> lockd: fix NLMv4 GRANTED_MSG handling Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Alexander Graf <graf(a)amazon.com> dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> ASoC: codecs: aw88261: only check PLL and clock state at power-up Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Yuqi Xu <xuyuqiabc(a)gmail.com> openvswitch: Fix CT limit teardown use-after-free Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Matthias Goergens <matthias.goergens(a)gmail.com> ocfs2: fix cached cluster count after suballocator reclaim Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Doruk Tan Ozturk <doruk(a)0sec.ai> ocfs2: validate directory-index entry counts when reading metadata Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Ivan Immanuel Shaji <ivanimmanuel1234(a)gmail.com> ring-buffer: Stop remote reader update when page swap fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Yuhang Pan <242270054(a)hdu.edu.cn> RDMA/uverbs: Guard legacy bundles without method_elm Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Embed counter driver data in rdma_counter allocation Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Guidong Han <2045gemini(a)gmail.com> RISC-V: KVM: Fix PMU event info array size overflow Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage Aurelien Jarno <aurelien(a)aurel32.net> riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Jianping Li <jianping.li(a)oss.qualcomm.com> arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Linkai Gong <gonglinkai(a)kylinos.cn> scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Tejun Heo <tj(a)kernel.org> sched_ext: Keep kick_sync waiting on the rq's own CPU Tejun Heo <tj(a)kernel.org> sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype Tao Cui <cuitao(a)kylinos.cn> sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users Tejun Heo <tj(a)kernel.org> sched_ext: Fix inverted ops.core_sched_before() invocation fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix exit_task leak on fork failure during enable fangqiurong <fangqiurong(a)kylinos.cn> sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection Tejun Heo <tj(a)kernel.org> sched_ext: Count rq lock releases in rq->scx.lock_drop_seq Tejun Heo <tj(a)kernel.org> sched_ext: Fix rq->core_pick corruption under core scheduling Tejun Heo <tj(a)kernel.org> sched_ext: Fix this_rq() assumptions in dispatch kfuncs Tejun Heo <tj(a)kernel.org> sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return Tejun Heo <tj(a)kernel.org> sched/core: Make core-sched flips wait for in-flight selections Tejun Heo <tj(a)kernel.org> sched/core: Handle pick_task() releasing the rq lock Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <cel(a)kernel.org> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <cel(a)kernel.org> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <cel(a)kernel.org> svcrdma: Reject Read lists that exceed the page budget Chuck Lever <cel(a)kernel.org> svcrdma: Reject oversized Read segments at decode time Chuck Lever <cel(a)kernel.org> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <cel(a)kernel.org> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Chuck Lever <cel(a)kernel.org> svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails Chuck Lever <cel(a)kernel.org> svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <cel(a)kernel.org> SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 Chuck Lever <cel(a)kernel.org> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Chris Mason <clm(a)meta.com> SUNRPC: fix gssx_dec_option_array error path bugs Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <cel(a)kernel.org> SUNRPC: close backchannel before destroying callback service Chuck Lever <cel(a)kernel.org> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Pratyush Yadav (Google) <pratyush(a)kernel.org> kho: fix size calculation in kho_preserved_memory_reserve() Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Dave Jiang <dave.jiang(a)intel.com> cxl/mce: Make the MCE notifier per-region Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Haoxiang Li <haoxiang_li2024(a)163.com> cpufreq: apple-soc: Fix OPP table cleanup Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Keith Busch <kbusch(a)kernel.org> block: validate user space vectors during extraction Junjie Cao <junjie.cao(a)linux.dev> backlight: aw99706: Honor the core blank state in update_status() Junjie Cao <junjie.cao(a)linux.dev> backlight: aw99706: Fix DT property names to match binding Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: TAD: Add locking around AML evaluations Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Avoid registering platform devices with resource overlaps Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Skip desired_perf read in cppc_get_perf() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Youngjae Kwon <yjkwon0026(a)snu.ac.kr> fsnotify: Fix stale object mask after concurrent mark updates Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Randy Dunlap <rdunlap(a)infradead.org> fonts: fixup font.h kernel-doc warnings Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Jan Kara <jack(a)suse.cz> ext2: Fix lost inode updates for IS_SYNC inodes Nikhil Gurudasani <nikhilgurudasani314(a)gmail.com> erofs: skip sufficiently large global buffers when resizing Jinjie Ruan <ruanjinjie(a)huawei.com> entry: Fix seccomp bypass after ptrace with TSYNC Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Hongling Zeng <zenghongling(a)kylinos.cn> ntfs: verify run length exceeding volume boundary Hongling Zeng <zenghongling(a)kylinos.cn> ntfs: validate non-resident attribute offsets Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: reject invalid MFT LCNs from boot sector Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: reject invalid empty mapping pairs Bryam Vargas <hexlabsecurity(a)proton.me> ntfs: bound the free-cluster bitmap scan to the volume Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: restore the data_offset bound in is_valid_oplock_break() Bryam Vargas <hexlabsecurity(a)proton.me> smb: client: reject a tree connect response whose byte count is too small Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> ksmbd: only rebind the reopened file's own oplock on durable reconnect Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 Jiangshan Yi <yijiangshan(a)kylinos.cn> smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Frank Sorenson <sorenson(a)redhat.com> cifs: call pagecache_isize_extended() in cifs_setsize() when extending Frank Sorenson <sorenson(a)redhat.com> cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: cap delegated inode count in ceph_parse_deleg_inos() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Max Kellermann <max.kellermann(a)ionos.com> ceph: force a cap message when a deferred revoke can't be acked immediately Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in check_new_map() on session freed during unlock Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Jeff Layton <jlayton(a)kernel.org> nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during delegation revoke Chuck Lever <cel(a)kernel.org> NFSD: Prevent client use-after-free during admin state revocation Chuck Lever <cel(a)kernel.org> NFSD: Prevent post-shutdown use-after-free in unlock_filesystem Chuck Lever <cel(a)kernel.org> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: release OPEN-decoded posix ACLs via op_release Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <cel(a)kernel.org> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix UAF in async copy cancel and shutdown Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure NeilBrown <neil(a)brown.name> nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() Chris Mason <clm(a)meta.com> nfsd: fix partial-write detection in nfsd_direct_write Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix layout fence worker double-reference race Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix clock domain mismatch in clients_still_reclaiming() Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke NeilBrown <neil(a)brown.name> nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: dedup nfs4_client_to_reclaim inserts Chris Mason <clm(a)meta.com> nfsd: convert nfsd_net boolean flags to unsigned long flags word Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Chris Mason <clm(a)meta.com> nfsd: cap decoded POSIX ACL count to bound sort cost Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <cel(a)kernel.org> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Jeff Layton <jlayton(a)kernel.org> nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths Chuck Lever <cel(a)kernel.org> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Jeff Layton <jlayton(a)kernel.org> lockd, nfsd: RCU-protect nlmsvc_ops dispatch Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Scott Mayhew <smayhew(a)redhat.com> NFSD: fix up error returned by write_threads() Chuck Lever <cel(a)kernel.org> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <cel(a)kernel.org> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <cel(a)kernel.org> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: set default primary compressor in zram_destroy_comps() Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in writeback_store() Longlong Xia <xialonglong(a)kylinos.cn> zram: fix out-of-bounds access in read_block_state() Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Karl Mehltretter <kmehltretter(a)gmail.com> KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Fix out-of-bounds access for newdevs mask Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Terry Bowman <terry.bowman(a)amd.com> cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Xu Rao <raoxu(a)uniontech.com> usb: typec: hd3ss3220: fix VBUS regulator error message Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Chun-Yi Lee <jlee(a)suse.com> debugfs: Fix lockdown check for mmap_prepare Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Ivan Immanuel Shaji <ivanimmanuel1234(a)gmail.com> tracing: Fix retry exhaustion in simple ring buffer reader swap Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Roger Pau Monne <roger(a)xenproject.org> x86/xen: fix init of balloon stats again Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Artem Lytkin <iprintercanon(a)gmail.com> mm/vmalloc: make vm_struct.nr_pages an unsigned long Shengming Hu <hu.shengming(a)zte.com.cn> mm/slub: prevent pfmemalloc objects from entering the barn Li Xiasong <lixiasong1(a)huawei.com> mm/slub: fix missing debugfs entries for caches created before sysfs init Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_migrate_one() Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Arvind Yadav <arvind.yadav(a)intel.com> mm/migrate_device: clear stale mapping after freeing swapcache Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Kairui Song <kasong(a)tencent.com> mm/mglru: fix and remove redundant unevictable folio handling Usama Arif <usama.arif(a)linux.dev> mm/mempolicy: skip non-present PMDs when queueing folios Usama Arif <usama.arif(a)linux.dev> mm/madvise: skip device-private PMDs in cold and pageout walks Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Muchun Song <muchun.song(a)linux.dev> mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Muchun Song <muchun.song(a)linux.dev> mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Zi Yan <ziy(a)nvidia.com> mm/huge_memory: use folio's memcg inside __folio_split() Usama Arif <usama.arif(a)linux.dev> mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Youngjun Park <youngjun.park(a)lge.com> mm, swap: don't free a hibernation slot that is in the swap cache Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: keep Rust objects out of Clang LTO with inline helpers Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: preserve unreachable traps with inline helpers Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Younes Akhouayri <git(a)younes.io> rust: num: restrict bool conversion to unsigned Bounded Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment Miguel Ojeda <ojeda(a)kernel.org> rust: kbuild: disambiguate `zerocopy_derive` for `rusttest` Danilo Krummrich <dakr(a)kernel.org> rust: devres: ensure revocation is complete before device finishes unbinding Danilo Krummrich <dakr(a)kernel.org> rust: devres: fix race between concurrent revokers Younes Akhouayri <git(a)younes.io> rust: dma: return zero for Coherent reads past EOF Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: prevent dead_code warning from warn_on!'s flags constant FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Antoni Boucher <bouanto(a)zoho.com> rust: kbuild: disambiguate `zerocopy` for `rusttest` Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Ke Sun <sunke(a)kylinos.cn> rust: fmt: fix {:p} printing stack addresses Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Chen Linxuan <me(a)black-desk.cn> pidfd: hold exec_update_lock around namespace ioctl Vivek Parikh <vivek.parikh(a)breachx.ai> ovl: fix double end_creating() on the casefold-mismatch path Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Christoph Hellwig <hch(a)lst.de> iomap: don't free integrity payload that doesn't exist Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Boris Burkov <boris(a)bur.io> btrfs: write-protect folios during data writeback Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort MBDRC register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Sort ADMAIF register defaults Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the MIXER enable default value Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix the I2S enable default value Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_mixer: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the Tegra264 register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: tegra210_i2s: sort the register default table Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Skip Update HDCP Config In Transition State ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 17 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/kodiak.dtsi | 9 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 - .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/arm64/kvm/vgic/vgic-v2.c | 3 +- arch/openrisc/kernel/entry.S | 43 ++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts | 4 +- arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts | 4 +- arch/riscv/include/asm/acpi.h | 19 + arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/riscv/kvm/vcpu_pmu.c | 14 +- arch/s390/include/asm/percpu.h | 4 +- arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++---- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 ++ arch/x86/kvm/emulate.c | 26 +- arch/x86/net/bpf_jit_comp.c | 2 +- block/bio.c | 56 ++- block/blk-map.c | 2 +- block/fops.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 +- drivers/acpi/acpi_platform.c | 45 ++- drivers/acpi/acpi_tad.c | 46 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 ++- drivers/acpi/cppc_acpi.c | 24 +- drivers/acpi/pfr_update.c | 45 +-- drivers/ata/libata-scsi.c | 28 +- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/block/zram/zram_drv.c | 14 +- drivers/bluetooth/btrtl.c | 13 - drivers/bluetooth/btusb.c | 14 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/cpufreq/apple-soc-cpufreq.c | 36 +- drivers/cpufreq/cppc_cpufreq.c | 2 +- drivers/crypto/atmel-ecc.c | 46 +-- drivers/crypto/intel/iaa/iaa_crypto_main.c | 27 +- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/mbox.c | 8 - drivers/cxl/core/mce.c | 27 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/core/ras_rch.c | 27 +- drivers/cxl/core/region.c | 43 +-- drivers/cxl/cxl.h | 11 +- drivers/cxl/cxlmem.h | 2 - drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 79 ++++ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 28 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 11 + drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 + drivers/hid/hid-mcp2221.c | 17 +- drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/device.c | 2 +- drivers/i3c/internals.h | 5 + drivers/i3c/master.c | 18 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 142 +++++--- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ib_core_uverbs.c | 3 + drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_main.c | 1 + drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_hw_stats.c | 95 +++-- drivers/infiniband/hw/ionic/ionic_ibdev.h | 11 +- drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 24 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 65 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/generic_pt/iommu_pt.h | 2 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 +- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +- drivers/md/dm-io.c | 96 +++-- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 + drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 +- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 +- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/qnap-mcu.c | 13 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +- drivers/net/ethernet/broadcom/bnxt/bnxt_gso.c | 4 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 5 + drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 ++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/net/wireless/realtek/rtw89/core.h | 1 + drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +- drivers/net/wireless/realtek/rtw89/pci.c | 13 + drivers/net/wireless/realtek/rtw89/pci.h | 1 + drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922de.c | 1 + drivers/ntb/ntb_transport.c | 38 +- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++- drivers/pci/controller/plda/pcie-starfive.c | 13 +- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 ++- drivers/pci/pcie/aer.c | 29 +- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 66 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/platform/x86/intel/int1092/intel_sar.c | 32 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 80 ++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/platform/x86/panasonic-laptop.c | 11 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 ++- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 +- drivers/power/supply/pf1550-charger.c | 2 +- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 ++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/fnic/fip.c | 2 +- drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 +-- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/hd3ss3220.c | 2 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- drivers/video/backlight/aw99706.c | 10 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + drivers/xen/balloon.c | 29 +- fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/extent_io.c | 31 ++ fs/btrfs/extent_io.h | 5 + fs/btrfs/inode.c | 23 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 +- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 74 +++- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 +- fs/ceph/mds_client.c | 73 +++- fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 11 +- fs/ceph/super.h | 14 + fs/ceph/xattr.c | 1 + fs/debugfs/file.c | 3 +- fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 +- fs/erofs/zutil.c | 2 + fs/ext2/inode.c | 7 +- fs/ext2/xattr.c | 4 +- fs/fat/misc.c | 4 + fs/fuse/dev.c | 8 +- fs/fuse/dev.h | 2 +- fs/fuse/dev_uring.c | 38 +- fs/fuse/dev_uring_i.h | 5 + fs/fuse/inode.c | 4 +- fs/iomap/bio.c | 2 +- fs/iomap/direct-io.c | 1 + fs/jbd2/checkpoint.c | 28 +- fs/lockd/clntproc.c | 3 + fs/lockd/lockd.h | 2 +- fs/lockd/svc.c | 4 +- fs/lockd/svc4proc.c | 7 +- fs/lockd/svcproc.c | 4 +- fs/lockd/svcsubs.c | 107 ++++-- fs/nfs/callback.c | 4 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 143 ++++---- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/lockd.c | 6 +- fs/nfsd/netns.h | 35 +- fs/nfsd/nfs2acl.c | 52 +-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 +++ fs/nfsd/nfs4callback.c | 113 +++++- fs/nfsd/nfs4layouts.c | 39 +- fs/nfsd/nfs4proc.c | 225 ++++++++---- fs/nfsd/nfs4recover.c | 48 ++- fs/nfsd/nfs4state.c | 399 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 40 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 156 ++++++-- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 49 ++- fs/nfsd/nfsxdr.c | 32 +- fs/nfsd/state.h | 4 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 39 +- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 17 +- fs/notify/inotify/inotify_user.c | 15 +- fs/ntfs/attrib.c | 24 +- fs/ntfs/lcnalloc.c | 7 +- fs/ntfs/runlist.c | 48 +++ fs/ntfs/super.c | 12 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++ fs/ocfs2/cluster/heartbeat.c | 150 ++++++-- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 47 ++- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 ++- fs/ocfs2/suballoc.c | 2 +- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/overlayfs/dir.c | 1 - fs/pidfs.c | 43 ++- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/cifsfs.h | 1 + fs/smb/client/cifssmb.c | 6 + fs/smb/client/dfs_cache.c | 33 +- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 56 ++- fs/smb/client/smb1misc.c | 3 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb1transport.c | 35 +- fs/smb/client/smb2file.c | 5 +- fs/smb/client/smb2inode.c | 6 +- fs/smb/client/smb2ops.c | 9 +- fs/smb/client/trace.h | 3 +- fs/smb/server/vfs_cache.c | 2 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/bio.h | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/entry-common.h | 3 + include/linux/font.h | 4 +- include/linux/hugetlb.h | 7 + include/linux/list.h | 15 +- include/linux/lockd/bind.h | 12 +- include/linux/sunrpc/bc_xprt.h | 5 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/uio.h | 10 +- include/linux/usb/tcpci.h | 1 + include/linux/vmalloc.h | 2 +- include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + io_uring/waitid.c | 33 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/dma/contiguous.c | 16 +- kernel/liveupdate/kexec_handover.c | 2 +- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 -- kernel/reboot.c | 29 ++ kernel/sched/core.c | 49 ++- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/sched/ext/ext.c | 342 +++++++++++++----- kernel/sched/sched.h | 5 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 202 +++++++---- kernel/trace/simple_ring_buffer.c | 4 +- kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/iov_iter.c | 9 +- lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++--- mm/gup.c | 10 +- mm/huge_memory.c | 24 +- mm/hugetlb.c | 38 +- mm/hugetlb_vmemmap.c | 23 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 77 ++-- mm/madvise.c | 4 +- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 + mm/mempolicy.c | 29 +- mm/migrate.c | 8 +- mm/migrate_device.c | 13 + mm/mm_init.c | 10 +- mm/page_alloc.c | 76 +++- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/pagewalk.c | 6 +- mm/rmap.c | 31 +- mm/slub.c | 80 +++-- mm/sparse-vmemmap.c | 4 +- mm/swapfile.c | 15 +- mm/vmalloc.c | 58 ++- mm/vmscan.c | 40 +-- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 ++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mctp/route.c | 19 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 128 ++++--- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 60 ++-- net/openvswitch/datapath.h | 8 +- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +- net/smc/smc_llc.c | 122 +++++-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_unseal.c | 3 + net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 15 +- net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/backchannel_rqst.c | 38 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 ++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 21 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 52 ++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++- net/sunrpc/xprtrdma/svc_rdma_transport.c | 69 +++- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/Makefile | 6 +- rust/kernel/bug.rs | 34 +- rust/kernel/devres.rs | 25 +- rust/kernel/dma.rs | 6 +- rust/kernel/fmt.rs | 9 +- rust/kernel/list.rs | 2 +- rust/kernel/num/bounded.rs | 31 +- rust/kernel/time.rs | 17 +- scripts/Makefile.build | 3 +- scripts/rust_is_available.sh | 14 + scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 +- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 ++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 ++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/codecs/realtek/alc662.c | 1 + sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/aw88261.c | 6 +- sound/soc/codecs/aw88261.h | 6 - sound/soc/tegra/tegra210_admaif.c | 210 +++++++---- sound/soc/tegra/tegra210_i2s.c | 24 +- sound/soc/tegra/tegra210_i2s.h | 1 + sound/soc/tegra/tegra210_mbdrc.c | 42 +-- sound/soc/tegra/tegra210_mixer.c | 10 +- sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- sound/usb/fcp.c | 4 +- tools/include/linux/compiler.h | 2 +- tools/objtool/check.c | 2 + tools/sched_ext/include/scx/compat.bpf.h | 12 +- tools/sched_ext/include/scx/enum_defs.autogen.h | 1 - tools/sched_ext/include/scx/enums.autogen.bpf.h | 3 - tools/sched_ext/include/scx/enums.autogen.h | 1 - tools/sched_ext/scx_qmap.bpf.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 621 files changed, 7838 insertions(+), 3129 deletions(-)

2 months, 1 week

[PATCH 6.18 000/551] 6.18.50-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.50 release. There are 551 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 07 Sep 2026 11:55:07 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.50-rc2 Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: avoid unnecessary use of is_swap_pmd() Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Refactor amdgpu_dm_connector_detect (v2) Roman Li <Roman.Li(a)amd.com> drm/amd/display: Skip PHY SSC reduction on some 8K panels David Howells <dhowells(a)redhat.com> netfs: Fix missing locking around retry adding new subreqs Rong Zhang <i(a)rong.moe> platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Christian Brauner <brauner(a)kernel.org> nsfs: tighten permission checks for handle opening Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Eric Dumazet <edumazet(a)google.com> ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/include/asm/acpi.h | 19 ++ arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/s390/kernel/perf_cpum_cf.c | 221 +++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 +++ arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 +++-- drivers/acpi/pfr_update.c | 45 ++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/bluetooth/btrtl.c | 13 -- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ----- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/cxl.h | 3 +- drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 114 ++++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 ++ drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++-- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 70 +++++- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++-- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 ++- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +-- drivers/md/dm-io.c | 96 ++++---- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 ++ drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 ++- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 ++- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 ++-- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 ++- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 +++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/aer.c | 29 ++- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 43 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/wmi-helpers.c | 4 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 ++- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/fat/misc.c | 4 + fs/fuse/dev.c | 3 +- fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 +++-- fs/netfs/read_retry.c | 6 +- fs/netfs/write_retry.c | 6 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 22 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/nfs2acl.c | 52 +++-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4callback.c | 113 +++++++-- fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 62 +++-- fs/nfsd/nfs4state.c | 253 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 26 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 129 ++++++++--- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/state.h | 3 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 34 +-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 5 +- fs/nsfs.c | 2 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 +++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 1 + fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 2 + include/linux/netdevice.h | 3 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 39 +++- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/bpf/verifier.c | 27 ++- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 --- kernel/reboot.c | 29 +++ kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 177 ++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++++---- mm/gup.c | 10 +- mm/huge_memory.c | 4 +- mm/hugetlb.c | 8 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 ++ mm/memory.c | 49 ++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/mm_init.c | 9 +- mm/page_alloc.c | 76 ++++++- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/pagewalk.c | 6 +- mm/rmap.c | 20 +- mm/swapfile.c | 6 +- mm/vmscan.c | 21 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +-- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++-- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++-- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +-- net/smc/smc_llc.c | 122 +++++++--- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 +++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/kernel/bug.rs | 8 +- rust/kernel/list.rs | 2 +- rust/kernel/time.rs | 17 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 +++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 504 files changed, 5464 insertions(+), 2549 deletions(-)

2 months, 1 week

[PATCH 6.12 000/400] 6.12.109-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.109 release. There are 400 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 07 Sep 2026 11:55:05 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.109-rc2 Dev Jain <dev.jain(a)arm.com> mm/rmap: use huge_ptep_get() in try_to_unmap_one() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: avoid unnecessary use of is_swap_pmd() Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ashish Kalra <ashish.kalra(a)amd.com> x86/sev: Fix broken SNP support with KVM module built-in Gao Shiyuan <gaoshiyuan(a)baidu.com> iommu/amd: remove return value of amd_iommu_detect Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 Ming Lei <tom.leiming(a)gmail.com> block: mark GFP_NOIO around sysfs ->store() Chao Yu <chao(a)kernel.org> f2fs: fix potential deadloop in prepare_compress_overwrite() Yang Erkun <yangerkun(a)huawei.com> md: make rdev_addable usable for rcu mode Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Mask the bd_cnt field in the TX BD properly ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 4 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/proc/task_mmu.c | 15 +- fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/hugetlb.h | 2 + include/linux/list.h | 15 +- include/linux/mm_types.h | 3 + include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/swapops.h | 12 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/huge_memory.c | 4 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/memory.c | 49 +++-- mm/mempolicy.c | 21 +- mm/migrate.c | 2 +- mm/page_owner.c | 10 +- mm/page_table_check.c | 12 +- mm/rmap.c | 60 ++++-- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 371 files changed, 3772 insertions(+), 1885 deletions(-)

2 months, 1 week

[PATCH 6.18 000/552] 6.18.50-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.50 release. There are 552 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.50-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Injae Ryou <injaeryou(a)gmail.com> selftests/mm: fix on-fault-limit false failure under sudo-rs Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Thomas Weißschuh (Schneider Electric) <thomas.weissschuh(a)linutronix.de> timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Oleg Nesterov <oleg(a)redhat.com> sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Xu Rao <raoxu(a)uniontech.com> zloop: truncate finished zones to zone capacity Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> wifi: mt76: mt7996: validate default EEPROM firmware size Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: cancel mlo_pm_work on stop Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Reconfigure the DATBAS register on re-attach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Clean DATBAS register on detach Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> i3c: renesas: Check that the transfer is valid before accessing it Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Runyu Xiao <runyu.xiao(a)seu.edu.cn> i3c: master: adi: initialize the lock before enabling interrupts Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix use-after-free and invalid seg operations in kset_replay() Jianyun Gao <jianyungao89(a)gmail.com> dm-pcache: fix implicit u8 truncation of gc_percent in message handler Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: only hand out initialized cache segments Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: detect a cycle in the last-kset chain during replay Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: clamp the tail kset read to the segment data region Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: bound the persisted tail-position offset Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate on-media seg_num against the cache device size Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate kset key_num and intra-segment bounds Bryam Vargas <hexlabsecurity(a)proton.me> dm-pcache: validate geometry fields from on-disk cache_info Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering Denis Batishchev <ii343hbka(a)gmail.com> ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Xu Rao <raoxu(a)uniontech.com> ALSA: hda/ext: preserve PPLCCTL bits when clearing reset Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Thomas Richard <thomas.richard(a)bootlin.com> mfd: cgbc: Fix teardown ordering in cgbc_remove() Can Peng <pengcan(a)kylinos.cn> hwrng: stm32 - Fix runtime PM cleanup on registration failure Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: stop killed, freed and out_of_sync sharing a byte Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Fix TX busy and drop handling Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: correctly validate returned PCS in phylink_inband_caps Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Runyu Xiao <runyu.xiao(a)seu.edu.cn> net: ibm: emac: mal: fix NAPI locking Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Corey Minyard <corey(a)minyard.net> ipmi:msghandler: Cancel work cleanly on an error Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yuho Choi <dbgh9129(a)gmail.com> ipmi: Remove all sysfs files on registration failure Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> io_uring/query: cap user size passed to copy_struct_to_user Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Propagate SMU errors and validate S2D address Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix current password length check Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Free system certificate signatures Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: think-lmi: Fix certificate thumbprint sysfs output Julian Haarmann <julian.haarmann(a)student.kit.edu> platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: cancel card-detect work on remove HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix UAF in selftest IOPF reporting Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Release current IOAS on xa_store() failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommufd: Avoid locking internal accesses during unmap Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Nicolin Chen <nicolinc(a)nvidia.com> iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Weimin Xiong <xiongwm2026(a)163.com> iommu/msm: Unwind probe state on registration failure Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Lukas Wunner <lukas(a)wunner.de> PCI/AER: Fix mapping of errors to agent & layer Lukas Wunner <lukas(a)wunner.de> PCI/AER: Emit TLP Log only for unmasked errors Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: qcom_battmgr: fix use-after-free Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Yifei Gao <gyf161023(a)gmail.com> ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Ruoyu Wang <ruoyuw560(a)gmail.com> i2c: mxs: fix DMA channel leak on probe error Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: proton-pack: Restore the nospectre_bhb command-line option Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Shibo Zhu <3499129952(a)qq.com> PM: sleep: Unblock runtime PM when device prepare fails Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_write_cm_event() Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Brett Creeley <brett.creeley(a)amd.com> RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Abdifatah Suruur <suruurism(a)gmail.com> ptp: vmclock: prevent read-only mappings from becoming writable Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Nam Cao <namcao(a)linutronix.de> riscv: unaligned: stop using kthread for check_vector_unaligned_access() Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3588s-roc-pc audio description Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Jakob Unterwurzacher <jakob.unterwurzacher(a)cherry.de> arm64: dts: rockchip: fix emmc reset polarity on px30-cobra Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 Michael Scott <mike.scott(a)oss.qualcomm.com> arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Oren Klopfer <oklopfer37(a)gmail.com> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Cong Nguyen <congnt264(a)gmail.com> media: staging/ipu7: fix async notifier UAF on probe error path Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Wentao Guan <guanwentao(a)uniontech.com> wifi: mt76: mt7925: cancel pending mlo_pm_work Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chris Mason <clm(a)meta.com> svcrdma: Reject Write/Reply chunks with segcount 0 Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Luxiao Xu <rakukuip(a)gmail.com> sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Jeff Layton <jlayton(a)kernel.org> sunrpc: defer rq_argp and rq_resp free until after RCU grace period Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Ameer Hamza <ameer.hamza(a)truenas.com> SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Felix Gu <ustc.gu(a)gmail.com> phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Stanislaw Gruszka <stf_xl(a)wp.pl> module/kallsyms: fix nextval for data symbol lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Thiébaud Weksteen <tweek(a)google.com> module: validate string table section types Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Günther Noack <gnoack(a)google.com> landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Andrea Mayer <andrea.mayer(a)uniroma2.it> ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Zhiling Zou <zhilinz(a)nebusec.ai> ip: orphan prefetched skbs before multicast forwarding Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Zhenhao Wan <whi4ed0g(a)gmail.com> cxl/features: bound fwctl command payload to the input buffer Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Mikulas Patocka <mpatocka(a)redhat.com> dm-io: report non-retryable errors separatedly Keith Busch <kbusch(a)kernel.org> dm-io: clone the source bio instead of copying its biovec Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Jia Zhu <zhujia.zj(a)bytedance.com> buffer: avoid tail commit walk for uptodate folios Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Joe Damato <joe(a)dama.to> bnxt_en: Write doorbell when linearizing skb fails Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Junjie Cao <junjie.cao(a)intel.com> Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Terry Bowman <terry.bowman(a)amd.com> acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ZhaoJinming <zhaojinming(a)uniontech.com> accel/rocket: Fix error path handling in rocket_job_run() Shuvam Pandey <shuvampandey1(a)gmail.com> accel/rocket: initialize job domain before cleanup paths Muhammad Bilal <meatuni001(a)gmail.com> accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() Guillaume Morin <guillaume(a)morinfr.org> hugetlb: only adjust reservation during unmapping if mapcount is 0 Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Chengfeng Ye <nicoyip.dev(a)gmail.com> fanotify: fix use-after-free of file range info Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown Guangshuo Li <lgs201920130244(a)gmail.com> HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HyeongJun An <sammiee5311(a)gmail.com> HID: intel-thc-hid: intel-quickspi: validate report size before copy Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Baul Lee <baul.lee(a)xbow.com> HID: universal-pidff: stop the device when force-feedback init fails Doruk Tan Ozturk <doruk(a)0sec.ai> HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Stuart Hayhurst <stuart.a.hayhurst(a)gmail.com> HID: corsair-void: Check size of status and firmware events before reading them Andre Eikmeyer <dev(a)deq.rocks> HID: apple: preserve keyboard backlight across T2 resume Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Frank Sorenson <sorenson(a)redhat.com> cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Qu Wenruo <wqu(a)suse.com> btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> btrfs: fix extent map leak in NOCOW direct I/O write Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Matthew Brown <matthew(a)bargrove.com> ceph: fix leaked inode reference on writeback abort at umount Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: hold rcu across localio cmpxchg retry Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix stale s2s_cp_stateids IDR entry for async COPY Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure Nikol Kuklev <nikolk202(a)gmail.com> nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix netlink dumpit error handling for rpc_status_get Jeff Layton <jlayton(a)kernel.org> nfsd: fix FL_SLEEP being set unconditionally for all LOCK types Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: don't free session slots that are still in use Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: clear CALLBACK_RUNNING on failed delegation recall queue Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Jeff Layton <jlayton(a)kernel.org> nfsd: validate sockaddr length per family in listener_set Jeff Layton <jlayton(a)kernel.org> nfsd: validate nseconds in TIME_DELEG decode paths Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Jeff Layton <jlayton(a)kernel.org> nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Nate Prodromou <nate(a)prodromou.com> NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails Chris Mason <clm(a)meta.com> NFS/localio: fix ref leak on nfs_uuid_add_file failure Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: validate deflate params Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Jason Yang <jason98166(a)gmail.com> phy: rockchip-samsung-dcphy: fix out-of-range max_register Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Fan Wu <fanwu01(a)zju.edu.cn> usb: typec: thunderbolt: Disable work before freeing tbt on remove Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Pei Xiao <xiaopei01(a)kylinos.cn> usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Yao Zi <me(a)ziyao.cc> x86/locking: Use sfence for wmb() if SSE is available Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Ridong Chen <chenridong(a)xiaomi.com> mm: vmscan: fix node reclaim ignoring swappiness parameter Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: fix non-movable reclaim storm in defrag_mode Vlastimil Babka (SUSE) <vbabka(a)kernel.org> mm: page_alloc: move capture_control to the page allocator Johannes Weiner <hannes(a)cmpxchg.org> mm: page_alloc: __GFP_FS lockdep annotation for direct compaction Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcontrol: update state_local when flushing NMI stats Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix memsw and TCP failcnt accounting Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings Johannes Weiner <hannes(a)cmpxchg.org> mm: compaction: support non-movable compaction for pageblock requests Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Hyunwoo Kim <imv4bel(a)gmail.com> mm/pagewalk: fix stale walk->action escaping walk_pmd_range() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Alexander Graf <graf(a)amazon.com> mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks David Hildenbrand (Arm) <david(a)kernel.org> mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() Breno Leitao <leitao(a)debian.org> mm, swap: ratelimit bad swap entry reports Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Chengfeng Ye <nicoyip.dev(a)gmail.com> KEYS: trusted: Fix TPM teardown ordering Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Nikolai Grlica <nikolai(a)nikolaigrlica.dev> rust: kernel: list: fix incorrect pop_back example comment FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: fix warn_on macro build error on UML FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: bug: skip arch-specific asm in `testlib` builds Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta WenTao Liang <vulab(a)iscas.ac.cn> clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() rounding near i64::MAX Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile Jerry Zuo <jerry.zuo(a)amd.com> drm/amd/display: hide Apple Studio Display secondary tile Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Refactor amdgpu_dm_connector_detect (v2) Roman Li <Roman.Li(a)amd.com> drm/amd/display: Skip PHY SSC reduction on some 8K panels David Howells <dhowells(a)redhat.com> netfs: Fix missing locking around retry adding new subreqs Rong Zhang <i(a)rong.moe> platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Christian Brauner <brauner(a)kernel.org> nsfs: tighten permission checks for handle opening Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Eric Dumazet <edumazet(a)google.com> ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Documentation/admin-guide/blockdev/zoned_loop.rst | 9 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 +- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 ++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 + arch/arm64/boot/dts/rockchip/px30-cobra.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 18 -- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 + arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts | 23 +- arch/arm64/kernel/compat_alignment.c | 4 +- arch/arm64/kernel/proton-pack.c | 9 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 +- arch/riscv/include/asm/acpi.h | 19 ++ arch/riscv/kernel/unaligned_access_speed.c | 19 +- arch/s390/kernel/perf_cpum_cf.c | 221 +++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/barrier.h | 2 +- arch/x86/include/asm/insn-eval.h | 36 +++ arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- block/genhd.c | 1 + drivers/accel/rocket/rocket_job.c | 32 ++- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 52 +++-- drivers/acpi/pfr_update.c | 45 ++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 + drivers/base/power/main.c | 1 + drivers/base/property.c | 19 +- drivers/block/zloop.c | 3 +- drivers/block/zram/backend_deflate.c | 10 +- drivers/bluetooth/btrtl.c | 13 -- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/hw_random/stm32-rng.c | 10 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 4 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-nxp-pit.c | 4 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ----- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -- drivers/cxl/core/features.c | 8 +- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/core/ras.c | 1 - drivers/cxl/cxl.h | 3 +- drivers/cxl/pci.c | 1 - drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 114 ++++++++-- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 24 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-apple.c | 18 +- drivers/hid/hid-corsair-void.c | 17 ++ drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 ++-- drivers/hid/hid-sony.c | 4 +- drivers/hid/hid-universal-pidff.c | 4 +- .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 10 +- .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 1 + .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 19 +- .../intel-quickspi/quickspi-protocol.h | 2 +- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i2c/busses/i2c-mxs.c | 5 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/adi-i3c-master.c | 15 +- drivers/i3c/master/renesas-i3c.c | 70 +++++- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 14 +- drivers/infiniband/core/uverbs_std_types_mr.c | 6 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/infiniband/hw/ionic/ionic_lif_cfg.c | 2 +- drivers/interconnect/core.c | 7 +- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++-- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/iommufd/device.c | 4 +- drivers/iommu/iommufd/ioas.c | 2 + drivers/iommu/iommufd/selftest.c | 31 ++- drivers/iommu/msm_iommu.c | 10 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-bufio.c | 10 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-integrity.c | 32 +-- drivers/md/dm-io.c | 96 ++++---- drivers/md/dm-kcopyd.c | 10 +- drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-log.c | 4 +- drivers/md/dm-pcache/cache.c | 18 ++ drivers/md/dm-pcache/cache.h | 21 ++ drivers/md/dm-pcache/cache_dev.c | 22 +- drivers/md/dm-pcache/cache_gc.c | 10 +- drivers/md/dm-pcache/cache_key.c | 32 ++- drivers/md/dm-pcache/cache_segment.c | 12 +- drivers/md/dm-pcache/cache_writeback.c | 10 +- drivers/md/dm-pcache/dm_pcache.c | 4 +- drivers/md/dm-raid1.c | 26 ++- drivers/md/dm-snap-persistent.c | 4 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/dm-verity-target.c | 2 +- drivers/md/dm-writecache.c | 14 +- drivers/md/md.c | 7 + drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/cgbc-core.c | 4 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 12 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +- drivers/net/ethernet/ibm/emac/mal.c | 13 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 38 ++-- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/phylink.c | 2 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 + drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 + drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 26 ++- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 +++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/aer.c | 29 ++- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 21 +- drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- drivers/platform/x86/amd/pmc/mp1_stb.c | 43 ++-- drivers/platform/x86/amd/pmc/pmc.c | 6 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/platform/x86/lenovo/think-lmi.c | 19 +- drivers/platform/x86/lenovo/wmi-helpers.c | 4 +- drivers/platform/x86/lenovo/ymc.c | 8 +- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 + drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 9 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/ptp/ptp_vmclock.c | 6 + drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/ipu7/ipu7-isys.c | 1 + drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 +- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/altmodes/thunderbolt.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 +++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/direct-io.c | 19 +- fs/btrfs/ioctl.c | 23 +- fs/btrfs/relocation.c | 31 ++- fs/buffer.c | 3 + fs/ceph/addr.c | 11 + fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 +++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/fat/misc.c | 4 + fs/fuse/dev.c | 3 +- fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 +++-- fs/netfs/read_retry.c | 6 +- fs/netfs/write_retry.c | 6 +- fs/nfs/nfs4client.c | 17 +- fs/nfs/pnfs.c | 3 +- fs/nfs_common/nfslocalio.c | 16 +- fs/nfsd/filecache.c | 22 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/localio.c | 8 +- fs/nfsd/nfs2acl.c | 52 +++-- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4callback.c | 113 +++++++-- fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 62 +++-- fs/nfsd/nfs4state.c | 253 ++++++++++++++++----- fs/nfsd/nfs4xdr.c | 26 ++- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 129 ++++++++--- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/state.h | 3 +- fs/nfsd/trace.h | 18 +- fs/nfsd/vfs.c | 34 +-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/notify/fanotify/fanotify.c | 3 +- fs/notify/fanotify/fanotify.h | 6 +- fs/notify/fanotify/fanotify_user.c | 5 +- fs/nsfs.c | 2 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 +++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/file.c | 1 + fs/smb/client/inode.c | 1 + fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/compaction.h | 3 +- include/linux/dm-io.h | 6 +- include/linux/list.h | 15 +- include/linux/netdevice.h | 3 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 39 +++- include/net/sctp/structs.h | 2 +- include/uapi/linux/landlock.h | 1 + io_uring/query.c | 3 + kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/bpf/verifier.c | 27 ++- kernel/module/kallsyms.c | 24 +- kernel/module/main.c | 14 +- kernel/params.c | 14 +- kernel/pid.c | 31 --- kernel/reboot.c | 29 +++ kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timekeeping.c | 8 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 177 ++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/compaction.c | 98 ++++---- mm/gup.c | 10 +- mm/hugetlb.c | 8 +- mm/internal.h | 10 +- mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol-v1.c | 6 +- mm/memcontrol.c | 13 ++ mm/mempolicy.c | 21 +- mm/migrate.c | 8 +- mm/mm_init.c | 9 +- mm/page_alloc.c | 76 ++++++- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/pagewalk.c | 6 +- mm/swapfile.c | 6 +- mm/vmscan.c | 21 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv4/ipmr.c | 3 + net/ipv6/exthdrs.c | 26 +-- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_input.c | 1 + net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++-- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 ++-- net/smc/af_smc.c | 3 +- net/smc/smc.h | 6 +- net/smc/smc_core.c | 27 +-- net/smc/smc_llc.c | 122 +++++++--- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/smc/smc_wr.c | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/clnt.c | 22 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 93 +++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 +- net/sunrpc/xprtrdma/svc_rdma_pcl.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 9 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 ++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- rust/kernel/bug.rs | 8 +- rust/kernel/list.rs | 2 +- rust/kernel/time.rs | 17 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/keys/trusted-keys/trusted_tpm1.c | 2 +- security/landlock/errata/abi-1.h | 23 ++ security/landlock/fs.c | 41 +++- security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/hda/codecs/realtek/alc269.c | 7 +- sound/hda/core/ext/stream.c | 4 +- sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 2 +- 498 files changed, 5399 insertions(+), 2514 deletions(-)

2 months, 1 week

[PATCH 6.12 000/403] 6.12.109-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.109 release. There are 403 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.109-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ashish Kalra <ashish.kalra(a)amd.com> x86/sev: Fix broken SNP support with KVM module built-in Gao Shiyuan <gaoshiyuan(a)baidu.com> iommu/amd: remove return value of amd_iommu_detect Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 Ming Lei <tom.leiming(a)gmail.com> block: mark GFP_NOIO around sysfs ->store() Chao Yu <chao(a)kernel.org> f2fs: fix potential deadloop in prepare_compress_overwrite() Yang Erkun <yangerkun(a)huawei.com> md: make rdev_addable usable for rcu mode Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Mask the bd_cnt field in the TX BD properly ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/list.h | 15 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/mempolicy.c | 21 +- mm/migrate.c | 8 +- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 366 files changed, 3709 insertions(+), 1854 deletions(-)

2 months, 1 week

[PATCH 7.2 00/71] 7.2.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.3 release. There are 71 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.3-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Trevor Vorhees <vorhees-work(a)proton.me> ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Eric Dumazet <edumazet(a)google.com> vlan: fix skb_under_panic and races when toggling HW VLAN offload Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Sean Christopherson <seanjc(a)google.com> KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Joanne Koong <joannelkoong(a)gmail.com> fuse: publish io-uring queues with release semantics Joanne Koong <joannelkoong(a)gmail.com> fuse: fix missing barrier when checking io-uring readiness Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix race between interrupt and resend Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jiayuan Chen <jiayuan.chen(a)linux.dev> selftests/bpf: Fix test_maps sockmap failure Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/svm/sev.c | 99 ++++++++---- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 63 -------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 ---- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 45 ------ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 --------------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 111 +++++++------ drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 ++ drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +------ drivers/crypto/qce/common.c | 55 ++----- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +--- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +---------- drivers/crypto/qcom-rng.c | 156 +++--------------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 18 ++- drivers/net/gtp.c | 21 ++- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 ++- drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 ++- drivers/usb/serial/spcp8x5.c | 13 -- fs/fuse/dev.c | 41 ++--- fs/fuse/dev_uring.c | 20 +-- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/skbuff.h | 24 +++ include/net/ip.h | 25 +++ include/net/ip6_route.h | 37 +++++ include/net/tcp.h | 5 + include/target/target_core_fabric.h | 2 + mm/swapfile.c | 7 + net/8021q/vlan_dev.c | 39 +---- net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ao.c | 19 ++- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/ah6.c | 29 ++-- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 7 + net/ipv6/tcp_ipv6.c | 2 +- net/netfilter/nf_tables_api.c | 36 +++-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/packet/af_packet.c | 96 +++++++++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++-- net/xfrm/xfrm_user.c | 2 +- sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + sound/usb/quirks-table.h | 10 ++ .../selftests/bpf/progs/sockmap_verdict_prog.c | 14 +- 83 files changed, 748 insertions(+), 1182 deletions(-)

2 months, 1 week

[PATCH 6.18 00/83] 6.18.49-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.49 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.49-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.49-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Antheas Kapenekakis <lkml(a)antheas.dev> HID: asus: simplify RGB init sequence Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Pavel Begunkov <asml.silence(a)gmail.com> io_uring/rsrc: improve regbuf iov validation Caleb Sander Mateos <csander(a)purestorage.com> io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Jesper Dangaard Brouer <hawk(a)kernel.org> veth: fix OOB txq access in veth_poll() with asymmetric queue counts Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Wentao Guan <guanwentao(a)uniontech.com> Revert "selinux: reject a permission value exceeding the class permission count" Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: use uncached mapping for UM queue BO Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in VRAM on dGFX Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in a separate BO Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 ++- arch/x86/kvm/svm/sev.c | 76 +++--- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/qcom-rng.c | 156 ++----------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpu/drm/xe/xe_bo.h | 14 ++ drivers/gpu/drm/xe/xe_guc_ads.c | 92 +++++--- drivers/gpu/drm/xe/xe_guc_ads_types.h | 5 + drivers/hid/hid-asus.c | 52 ++--- drivers/hid/hid-ft260.c | 41 +++- drivers/hid/hid-magicmouse.c | 25 +- drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/net/gtp.c | 21 +- drivers/net/veth.c | 3 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 +++++++++++++-- fs/smb/server/vfs_cache.h | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/io_uring_types.h | 8 + include/linux/skbuff.h | 24 ++ include/target/target_core_fabric.h | 2 + io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 21 +- io_uring/io_uring.c | 7 +- io_uring/poll.c | 23 +- io_uring/rsrc.c | 31 +-- io_uring/waitid.c | 2 +- kernel/bpf/offload.c | 10 +- mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/tcp_ao.c | 19 +- net/ipv6/ah6.c | 29 ++- net/ipv6/seg6_local.c | 7 + net/netfilter/nf_tables_api.c | 36 +-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 25 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 254 +++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/soc/codecs/nau8821.c | 13 ++ sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 88 files changed, 1156 insertions(+), 776 deletions(-)

2 months, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage September 2026