- Lkft-triage - lists.linaro.org

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.9 release. There are 201 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.9-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.9-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Lorenzo Stoakes <ljs(a)kernel.org> mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() Markus Mayer <mmayer(a)broadcom.com> perf build: fix "argument list too long" in second location Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() Tejun Heo <tj(a)kernel.org> cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated Petr Malat <oss(a)malat.biz> cgroup: Increment nr_dying_subsys_* from rmdir context Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Shubhrajyoti Datta <shubhrajyoti.datta(a)amd.com> EDAC/versalnet: Refactor memory controller initialization and cleanup Breno Leitao <leitao(a)debian.org> kho: fix error handling in kho_add_subtree() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Franz Schnyder <franz.schnyder(a)toradex.com> arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com> arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/sti: remove bridge when sti_hda component_add fails Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu/userq: fix access to stale wptr mapping Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande(a)amd.com> drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and higher. Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0 . Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Add missing firmware declaration for PSP v15.0.0 Wenjing Liu <wenjing.liu(a)amd.com> drm/amd/display: fix math_mod() using arg1 instead of arg2 Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/v3d: Reject empty multisync extension to prevent infinite loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Harry Wentland <harry.wentland(a)amd.com> drm/colorop: Fix blob property reference tracking in state lifecycle Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: octeon: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ep93xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Gustavo Sousa <gustavo.sousa(a)intel.com> drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Vikash Garodia <vikash.garodia(a)oss.qualcomm.com> media: iris: switch to hardware mode after firmware boot Vishnu Reddy <busanna.reddy(a)oss.qualcomm.com> media: iris: fix use-after-free of fmt_src during MBPF check Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/atomic: Add affected colorops with affected planes Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/colorop: Preserve bypass value in duplicate_state() Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Hans de Goede <johannes.goede(a)oss.qualcomm.com> media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440 Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Franz Schnyder <franz.schnyder(a)toradex.com> arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Fully reset the ISP configuration Dang Huynh <dang.huynh(a)mainlining.org> media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Xiaolei Wang <xiaolei.wang(a)windriver.com> media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Felix Gu <ustc.gu(a)gmail.com> media: ti: vpe: Add missing v4l2_device_unregister in vip_remove() Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label position Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Fix wrong comment of ISP block types Daniel Scally <dan.scally(a)ideasonboard.com> media: mali-c55: Fix Iridix bypass macros Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Initialize the ISP in enable_streams() Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix concurrent buffer list access Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix FM_STOP register write Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Write AXIRX_PIXFMT once Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Jacopo Mondi <jacopo.mondi+renesas(a)ideasonboard.com> media: rzv2h-ivc: Avoid double job scheduling Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 ++ .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + .../boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 - arch/arm64/boot/dts/qcom/kodiak.dtsi | 2 +- arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts | 2 +- arch/arm64/boot/dts/ti/k3-am69-aquila-dev.dts | 2 +- drivers/edac/versalnet_edac.c | 182 ++++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 ++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 97 ++++---- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 9 +- drivers/gpu/drm/amd/amdgpu/psp_v15_0.c | 1 + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 ++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../src/dml2_standalone_libraries/lib_float_math.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_atomic.c | 7 + drivers/gpu/drm/drm_colorop.c | 28 ++- drivers/gpu/drm/drm_gem.c | 25 ++- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 ++-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sti/sti_hda.c | 8 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/v3d/v3d_submit.c | 5 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 ++++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +++-- drivers/hid/hid-core.c | 67 ++++-- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov5647.c | 12 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu-bridge.c | 14 ++ drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 +++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/arm/mali-c55/mali-c55-common.h | 2 + .../media/platform/arm/mali-c55/mali-c55-core.c | 35 --- drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 37 +-- .../media/platform/arm/mali-c55/mali-c55-params.c | 128 ++++++++++- .../platform/arm/mali-c55/mali-c55-registers.h | 4 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 +++---- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_core.c | 4 + drivers/media/platform/qcom/iris/iris_hfi_common.c | 4 + drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vdec.c | 6 - drivers/media/platform/qcom/iris/iris_vdec.h | 1 - drivers/media/platform/qcom/iris/iris_venc.c | 6 - drivers/media/platform/qcom/iris/iris_venc.h | 1 - drivers/media/platform/qcom/iris/iris_vidc.c | 6 +- drivers/media/platform/qcom/iris/iris_vpu2.c | 1 + drivers/media/platform/qcom/iris/iris_vpu3x.c | 9 +- drivers/media/platform/qcom/iris/iris_vpu4x.c | 24 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 16 +- drivers/media/platform/qcom/iris/iris_vpu_common.h | 3 + drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 35 +-- .../media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 8 +- drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- .../platform/rockchip/rkcif/rkcif-interface.c | 3 +- .../media/platform/rockchip/rkcif/rkcif-stream.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/platform/ti/vpe/vip.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence-quadspi.c | 40 ++-- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-octeon.c | 8 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-ep93xx.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 ++-- drivers/usb/typec/tcpm/tcpm.c | 2 + include/linux/cgroup-defs.h | 4 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/mm.h | 2 +- io_uring/zcrx.c | 17 +- kernel/cgroup/cgroup.c | 248 ++++++++++----------- kernel/liveupdate/kexec_handover.c | 13 +- kernel/sched/ext.c | 12 +- mm/util.c | 51 +++-- mm/vma.c | 3 +- net/batman-adv/bat_iv_ogm.c | 85 ++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 ++++++++-- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++--- tools/perf/pmu-events/Build | 4 +- tools/testing/vma/include/dup.h | 41 ++-- tools/testing/vma/include/stubs.h | 3 +- 200 files changed, 1917 insertions(+), 988 deletions(-)

27 minutes

14
13
0 0

[PATCH 6.6 000/474] 6.6.140-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.140 release. There are 474 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.140-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.140-rc1 Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Jianpeng Chang <jianpeng.chang.cn(a)windriver.com> Bluetooth: MGMT: Fix memory leak in set_ssp_complete Amit Kumar Mahapatra <amit.kumar-mahapatra(a)amd.com> mtd: spi-nor: sst: Fix SST write failure Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Bence Csókás <csokas.bence(a)prolan.hu> mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Li Zetao <lizetao1(a)huawei.com> spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: uniphier: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun6i: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: zynq-qspi: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: spi-ti-qspi: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun4i: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: synquacer: switch to use modern name David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Deren Wu <deren.wu(a)mediatek.com> wifi: mt76: connac: introduce helper for mt7925 chipset Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Namjae Jeon <linkinjeon(a)kernel.org> smb: common: change the data type of num_aces to le16 ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb: move some duplicate definitions to common/smbacl.h Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports Paul E. McKenney <paulmck(a)kernel.org> exit: Sleep at TASK_IDLE when waiting for application core dump Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate fake register spill/fill precision backtracking logic Andrii Nakryiko <andrii(a)kernel.org> bpf: handle fake register spill to stack with BPF_ST_MEM instruction Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros Andrii Nakryiko <andrii(a)kernel.org> bpf: track aligned STACK_ZERO cases as imprecise spilled registers Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate zero preservation for sub-slot loads Andrii Nakryiko <andrii(a)kernel.org> bpf: preserve constant zero when doing partial register restore Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate STACK_ZERO is preserved on subreg spill Andrii Nakryiko <andrii(a)kernel.org> bpf: preserve STACK_ZERO slots on partial reg spills Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: add stack access precision test Andrii Nakryiko <andrii(a)kernel.org> bpf: support non-r10 register spill/fill to/from stack in precision tracking Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix leaking event log memory Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix crash when the event log is disabled Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Dong Chenchen <dongchenchen2(a)huawei.com> net: Fix icmp host relookup triggering ip_rt_bug Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Chao Yu <chao(a)kernel.org> f2fs: fix to detect potential corrupted nid in free_nid_list Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> regset: use kvzalloc() for regset_get_alloc() Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix possible UAFs Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/Makefile | 2 +- arch/s390/kernel/debug.c | 5 + arch/um/drivers/cow_user.c | 8 +- arch/x86/kernel/shstk.c | 45 ++- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 +-- arch/x86/kvm/svm/nested.c | 56 +++- arch/x86/kvm/svm/svm.c | 17 ++ arch/x86/kvm/svm/svm.h | 2 + arch/x86/kvm/x86.c | 62 ++-- block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk.h | 21 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/bus/imx-weim.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++- drivers/char/ipmi/ipmi_ssif.c | 36 ++- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.c | 47 +-- drivers/crypto/nx/nx-842.h | 25 +- drivers/crypto/nx/nx-common-powernv.c | 31 +- drivers/crypto/nx/nx-common-pseries.c | 33 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/dma/idxd/device.c | 3 +- drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 29 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 7 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/hid/hid-playstation.c | 6 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/ttusbir.c | 13 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 8 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/core/quirks.h | 9 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/mtd/spi-nor/sst.c | 50 +-- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76_connac.h | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mac.c | 4 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/core.c | 2 +- drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 1 - drivers/parisc/lasi.c | 12 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/pwm/pwm-imx-tpm.c | 8 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 5 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 41 +-- drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 9 + drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 9 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-sun4i.c | 80 ++--- drivers/spi/spi-sun6i.c | 154 +++++----- drivers/spi/spi-synquacer.c | 88 +++--- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 97 +++--- drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-uniphier.c | 212 +++++++------ drivers/spi/spi-zynq-qspi.c | 79 ++--- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 63 ++-- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 ++- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++--- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 +- fs/binfmt_elf.c | 2 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 2 +- fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/extents.c | 15 + fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 32 +- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 17 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 177 ++++++++--- fs/smb/client/cifsacl.h | 91 +----- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/common/smbacl.h | 122 ++++++++ fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/smbacl.c | 48 +-- fs/smb/server/smbacl.h | 113 +------ fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/smb/server/vfs_cache.c | 40 ++- fs/tracefs/event_inode.c | 14 + fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/bpf_verifier.h | 31 +- include/linux/damon.h | 2 + include/linux/device.h | 45 +++ include/linux/f2fs_fs.h | 1 + include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 44 ++- include/linux/mmap_lock.h | 6 +- include/linux/mmc/card.h | 1 + include/linux/padata.h | 4 - include/linux/printk.h | 13 + include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- include/video/udlfb.h | 1 + init/main.c | 1 - io_uring/poll.c | 14 +- io_uring/timeout.c | 4 + kernel/bpf/verifier.c | 236 +++++++++----- kernel/exit.c | 3 +- kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/regset.c | 6 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 37 ++- mm/damon/lru_sort.c | 88 ++++-- mm/damon/reclaim.c | 88 ++++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++-- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 47 ++- net/bluetooth/l2cap_sock.c | 9 + net/bluetooth/mgmt.c | 262 +++++++++++----- net/bluetooth/mgmt_util.c | 46 +++ net/bluetooth/mgmt_util.h | 3 + net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 4 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 29 +- net/ipv4/icmp.c | 8 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/ah6.c | 27 +- net/ipv6/exthdrs.c | 9 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/nft_bitwise.c | 3 +- net/openvswitch/vport-netdev.c | 6 +- net/qrtr/ns.c | 86 +++++- net/rds/message.c | 20 +- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 27 +- net/rxrpc/conn_event.c | 44 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/sched/sch_red.c | 2 +- net/sctp/socket.c | 9 + net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/unix/af_unix.c | 3 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 15 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 +--- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 44 +-- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/drivers/pcmtest.c | 19 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/hda/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/stream.c | 4 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/testing/ktest/ktest.pl | 2 +- .../selftests/bpf/progs/verifier_spill_fill.c | 281 +++++++++++++++++ .../bpf/progs/verifier_subprog_precision.c | 87 +++++- tools/testing/selftests/bpf/verifier/precise.c | 38 ++- .../testing/selftests/mqueue/{setting => settings} | 0 447 files changed, 5555 insertions(+), 2927 deletions(-)

17 hours, 19 minutes

11
10
0 0

[PATCH 6.12 000/143] 6.12.90-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.90 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 18 May 2026 10:21:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.90-rc2 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Damien Le Moal <dlemoal(a)kernel.org> block: reorganize struct blk_zone_wplug Damien Le Moal <dlemoal(a)kernel.org> block: cleanup blkdev_report_zones() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: Makefile | 6 +- .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 +++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- block/blk-zoned.c | 170 +++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 11 +- drivers/hid/hid-playstation.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++++-- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/net/bonding/bond_main.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 ++- drivers/spi/spi-zynq-qspi.c | 55 ++----- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +++-- drivers/usb/dwc3/core.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fbcon_rotate.c | 5 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/tracefs/inode.c | 1 + include/linux/damon.h | 2 + include/uapi/linux/io_uring.h | 3 +- io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- mm/damon/core.c | 34 +++++ mm/damon/lru_sort.c | 88 +++++++---- mm/damon/reclaim.c | 88 +++++++---- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 ++- net/bluetooth/l2cap_sock.c | 3 + net/sctp/socket.c | 9 ++ net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 +++---- rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- sound/core/misc.c | 33 ++-- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/pci/hda/cs35l56_hda.c | 19 ++- 131 files changed, 1264 insertions(+), 586 deletions(-)

20 hours, 3 minutes

6
5
0 0

[PATCH 6.18 000/187] 6.18.32-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.32 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 18 May 2026 10:22:18 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.32-rc2 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: optimization for entry only case Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: use rhltable for fprobe_ip_table Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Add dwc pointer to dwc3_readl/writel Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Remove of dep->regs Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters zhidao su <suzhidao(a)xiaomi.com> sched/ext: Implement cgroup_set_idle() callback David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler Christian Brauner <brauner(a)kernel.org> papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: rework how we handle TLB fences Prike Liang <Prike.Liang(a)amd.com> Revert "drm/amdgpu: don't attach the tlb fence for SI" Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: validate the flush_gpu_tlb_pasid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 + .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 + arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/main.c | 35 +- arch/loongarch/kvm/switch.S | 20 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +-- block/blk-zoned.c | 149 +++----- drivers/edac/versalnet_edac.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_gem.c | 25 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 1 + drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 +-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +-- drivers/hid/hid-core.c | 67 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 ++-- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/spi/spi-zynq-qspi.c | 55 +-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +- drivers/usb/dwc3/core.c | 204 +++++----- drivers/usb/dwc3/core.h | 10 +- drivers/usb/dwc3/debugfs.c | 44 +-- drivers/usb/dwc3/drd.c | 76 ++-- drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 162 ++++---- drivers/usb/dwc3/gadget.h | 4 +- drivers/usb/dwc3/io.h | 7 +- drivers/usb/dwc3/ulpi.c | 10 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/bitblit.c | 120 +++--- drivers/video/fbdev/core/fbcon.c | 419 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++---- drivers/video/fbdev/core/fbcon_cw.c | 146 +++---- drivers/video/fbdev/core/fbcon_rotate.c | 43 ++- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- include/linux/damon.h | 1 + include/linux/fprobe.h | 3 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/sched/ext.h | 1 + io_uring/zcrx.c | 17 +- kernel/sched/ext.c | 23 +- kernel/sched/ext_internal.h | 13 +- kernel/trace/fprobe.c | 380 +++++++++++++------ mm/damon/core.c | 25 +- mm/damon/lru_sort.c | 83 ++-- mm/damon/reclaim.c | 83 ++-- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++- 196 files changed, 2698 insertions(+), 1707 deletions(-)

23 hours, 8 minutes

6
5
0 0

[PATCH 6.18 000/188] 6.18.32-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.32 release. There are 188 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.32-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: optimization for entry only case Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: use rhltable for fprobe_ip_table Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Add dwc pointer to dwc3_readl/writel Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Remove of dep->regs Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters zhidao su <suzhidao(a)xiaomi.com> sched/ext: Implement cgroup_set_idle() callback David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler Christian Brauner <brauner(a)kernel.org> papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: rework how we handle TLB fences Prike Liang <Prike.Liang(a)amd.com> Revert "drm/amdgpu: don't attach the tlb fence for SI" Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: validate the flush_gpu_tlb_pasid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 + .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 + arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/main.c | 35 +- arch/loongarch/kvm/switch.S | 20 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +-- block/blk-zoned.c | 149 +++----- drivers/edac/versalnet_edac.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_gem.c | 25 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 1 + drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 +-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +-- drivers/hid/hid-core.c | 67 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 ++-- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/spi/spi-zynq-qspi.c | 55 +-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +- drivers/usb/dwc3/core.c | 204 +++++----- drivers/usb/dwc3/core.h | 10 +- drivers/usb/dwc3/debugfs.c | 44 +-- drivers/usb/dwc3/drd.c | 76 ++-- drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 162 ++++---- drivers/usb/dwc3/gadget.h | 4 +- drivers/usb/dwc3/io.h | 7 +- drivers/usb/dwc3/ulpi.c | 10 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/bitblit.c | 120 +++--- drivers/video/fbdev/core/fbcon.c | 419 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++---- drivers/video/fbdev/core/fbcon_cw.c | 146 +++---- drivers/video/fbdev/core/fbcon_rotate.c | 43 ++- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- include/linux/damon.h | 1 + include/linux/fprobe.h | 3 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/sched/ext.h | 1 + io_uring/zcrx.c | 17 +- kernel/sched/ext.c | 26 +- kernel/sched/ext_internal.h | 13 +- kernel/trace/fprobe.c | 380 +++++++++++++------ mm/damon/core.c | 25 +- mm/damon/lru_sort.c | 83 ++-- mm/damon/reclaim.c | 83 ++-- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++- 196 files changed, 2699 insertions(+), 1709 deletions(-)

1 day, 3 hours

10
10
0 0

[PATCH 6.12 000/144] 6.12.90-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.90 release. There are 144 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.90-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Damien Le Moal <dlemoal(a)kernel.org> block: reorganize struct blk_zone_wplug Damien Le Moal <dlemoal(a)kernel.org> block: cleanup blkdev_report_zones() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: Makefile | 6 +- .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 +++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- block/blk-zoned.c | 170 +++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 11 +- drivers/hid/hid-playstation.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++++-- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/net/bonding/bond_main.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 ++- drivers/spi/spi-zynq-qspi.c | 55 ++----- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +++-- drivers/usb/dwc3/core.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fbcon_rotate.c | 5 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/tracefs/inode.c | 1 + include/linux/damon.h | 2 + include/uapi/linux/io_uring.h | 3 +- io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + kernel/sched/ext.c | 3 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- mm/damon/core.c | 34 +++++ mm/damon/lru_sort.c | 88 +++++++---- mm/damon/reclaim.c | 88 +++++++---- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 ++- net/bluetooth/l2cap_sock.c | 3 + net/sctp/socket.c | 9 ++ net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 +++---- rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- sound/core/misc.c | 33 ++-- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/pci/hda/cs35l56_hda.c | 19 ++- 132 files changed, 1265 insertions(+), 588 deletions(-)

1 day, 11 hours

10
12
0 0

Mise à jour de sécurité de vos cartes clés personnelles

by unknown＠example.com

● Vous avez reçu une information Merci d'en prendre connaissance dans les meilleurs délais. Une prise d’initiative de votre part pourrait être nécessaire. Cliquez ci-dessous pour y accéder : Accéder à mon compte Mentions Légales Vous recevez ce message parce que vous nous avez communiqué votre adresse e-mail. Nous recueillons des statistiques d'ouverture des emails grâce à l'affichage des images incluses dans le message. Lorsque votre application email le permet, vous pouvez à tout moment les accepter ou les refuser en paramétrant leur affichage. Le CIC garantit l'utilisation de vos données personnelles dans le respect de la législation. Si vous ne souhaitez plus recevoir de communication commerciale de notre part, cliquez ici. Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de son ou ses destinataires. Si vous avez reçu ce message par erreur, merci d'en avertir immédiatement l'émetteur et de détruire le message. Une banque qui appartient à ses clients, ça change tout.  

2 days, 17 hours

1
0
0 0

2026年上海MWC——参会者名录

by Pamela Kelly

您好，我们目前正提供 MWC 上海 2026 参会者名单的访问权限，该名单包含了 44,753 位经过验证且已明确同意接收信息的参会联系人。该数据库涵盖了姓名、职位、公司名称、电话号码及官方电子邮箱等信息，助您高效触达关键决策者，并有力支持您的销售线索挖掘工作。如果您对此感兴趣，请告知我，我很乐意为您提供详细的报价信息。诚挚地， Pamela Kelly 高级需求生成专员附注：如不希望继续接收此类信息，请回复“No Thanks”。

3 days, 5 hours

1
0
0 0

[PATCH 6.18 000/268] 6.18.30-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 268 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:20 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 264 files changed, 2397 insertions(+), 1123 deletions(-)

3 days, 16 hours

8
7
0 0

[PATCH 6.12 000/206] 6.12.88-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 41 ++--- drivers/crypto/nx/nx-842.h | 15 +- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 227 files changed, 1903 insertions(+), 785 deletions(-)

3 days, 19 hours

10
9
0 0

[PATCH 6.12 000/202] 6.12.88-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 8 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 220 files changed, 1766 insertions(+), 684 deletions(-)

3 days, 19 hours

8
7
0 0

[PATCH 7.0 000/305] 7.0.7-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 305 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 19 +- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3030 insertions(+), 1615 deletions(-)

3 days, 19 hours

12
12
0 0

[PATCH 6.18 000/270] 6.18.30-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 270 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 +++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +--- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 ++- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 ++-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 269 files changed, 2440 insertions(+), 1165 deletions(-)

4 days, 15 hours

8
7
0 0

[PATCH 7.0 000/307] 7.0.7-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 28 ++- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3041 insertions(+), 1615 deletions(-)

4 days, 15 hours

8
8
0 0

[PATCH 6.12 000/215] 6.12.86-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.86 release. There are 215 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.86-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.86-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue David Hildenbrand <david(a)redhat.com> mm/migrate: move movable_ops page handling out of move_to_new_folio() David Hildenbrand <david(a)redhat.com> mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Jinjiang Tu <tujinjiang(a)huawei.com> mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Miguel Ojeda <ojeda(a)kernel.org> rust: init: fix `clippy::undocumented_unsafe_blocks` warnings Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 5 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 55 ++-- arch/x86/kvm/svm/svm.c | 32 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 62 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/jbd2/revoke.c | 8 +- fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cifsacl.c | 116 +++++-- fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/padata.h | 4 - include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 15 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 3 +- mm/internal.h | 10 + mm/memory_hotplug.c | 10 +- mm/migrate.c | 152 +++++---- mm/mlock.c | 10 +- mm/mmap.c | 4 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 25 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/init/macros.rs | 7 +- scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/pcmtest.c | 19 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/landlock/net_test.c | 2 +- .../testing/selftests/mqueue/{setting => settings} | 0 218 files changed, 2506 insertions(+), 1555 deletions(-)

6 days, 23 hours

11
10
0 0

[PATCH 6.18 000/275] 6.18.27-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.27 release. There are 275 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:54 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.27-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.27-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Ronak Raheja <ronak.raheja(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: mm: Simplify check in arch_kfence_init_pool() Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Brahmajit Das <listout(a)listout.xyz> ASoC: Intel: avs: replace strcmp with sysfs_streq Tiezhu Yang <yangtiezhu(a)loongson.cn> drm/amd: Fix set but not used warnings Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 +++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 92 +++--- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 3 + arch/parisc/include/asm/checksum.h | 89 +----- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 195 +++++++----- arch/x86/kvm/svm/svm.c | 139 +++++++-- arch/x86/kvm/svm/svm.h | 11 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 1 + drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 4 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- fs/afs/file.c | 12 +- fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 22 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 ++ include/linux/alloc_tag.h | 2 + include/linux/damon.h | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 60 ++-- mm/damon/stat.c | 5 +- mm/filemap.c | 3 +- mm/hugetlb.c | 3 + mm/internal.h | 11 +- mm/mempolicy.c | 23 +- mm/migrate.c | 17 ++ mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 29 +- mm/truncate.c | 6 +- mm/vma.c | 4 +- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- security/landlock/cred.c | 6 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 +++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/soc/intel/avs/path.c | 2 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 +++++-- tools/testing/selftests/landlock/audit_test.c | 124 ++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/vma_internal.h | 7 +- 274 files changed, 3267 insertions(+), 1877 deletions(-)

1 week, 4 days

10
10
0 0

[PATCH 7.0 000/307] 7.0.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.4 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.4-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix segfault when updating ftrace mask Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: avoid deadlock when holding rmap on mmap_prepare error Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: various small mmap_prepare cleanups Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable WANG Rui <r(a)hev.cc> perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Pierre Barre <pierre(a)barre.sh> 9p: fix access mode flags being ORed instead of replaced Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Marc Zyngier <maz(a)kernel.org> KVM: arm64: Account for RESx bits in __compute_fgt() Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Chenghao Duan <duanchenghao(a)kylinos.cn> mm/memfd_luo: fix physical address conversion in put_folios cleanup Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix AXIRX_VBLANK register write Daniel Scally <dan.scally+renesas(a)ideasonboard.com> media: rzv2h-ivc: Revise default VBLANK formula Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Daniel J Blueman <daniel(a)quora.org> apparmor: Fix string overrun due to missing termination Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers Petr Mladek <pmladek(a)suse.com> printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Helge Deller <deller(a)gmx.de> module.lds.S: Fix modules on 32-bit parisc architecture Joe Lawrence <joe.lawrence(a)redhat.com> module.lds,codetag: force 0 sh_addr for sections Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: fix user_struct uaf Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: return back two step unregistration Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Matthew Brost <matthew.brost(a)intel.com> mm/zone_device: do not touch device folio after calling ->folio_free() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1 Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Franz Schnyder <franz.schnyder(a)toradex.com> PCI: imx6: Fix reference clock source selection for i.MX95 Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damos_walk() vs kdamond_fn() exit race SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Michael Riesch <michael.riesch(a)collabora.com> media: rockchip: rkcif: comply with minimum number of buffers requirement Dan Carpenter <dan.carpenter(a)linaro.org> media: rockchip: rkcif: fix off by one bugs Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Add a missing vfio_pci_core_release_dev() Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Lance Yang <lance.yang(a)linux.dev> mm: fix deferred split queue races during migration Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Thomas Weißschuh <linux(a)weissschuh.net> sysfs: attribute_group: Respect is_visible_const() when changing owner Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 ++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/Kconfig | 7 + arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/kvm/config.c | 4 +- arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 81 +++-- arch/loongarch/include/asm/irq_work.h | 2 +- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 4 + arch/parisc/include/asm/checksum.h | 89 +---- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 201 +++++++----- arch/x86/kvm/svm/svm.c | 150 +++++++-- arch/x86/kvm/svm/svm.h | 17 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/clk/samsung/clk-acpm.c | 4 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 ++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/firmware/samsung/exynos-acpm-dvfs.c | 4 +- drivers/firmware/samsung/exynos-acpm-dvfs.h | 4 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 ++- drivers/gpu/drm/imagination/pvr_fw_trace.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 16 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 9 +- .../media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 2 +- .../platform/rockchip/rkcif/rkcif-capture-mipi.c | 10 +- .../media/platform/rockchip/rkcif/rkcif-stream.c | 44 +-- drivers/media/rc/igorplugusb.c | 16 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/sec-acpm.c | 10 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++-- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 ++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 5 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- drivers/vfio/pci/xe/main.c | 1 + drivers/video/fbdev/core/fb_defio.c | 178 +++++++--- fs/9p/v9fs.c | 4 + fs/afs/file.c | 12 +- fs/backing-file.c | 18 +- fs/ceph/addr.c | 4 + fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 28 +- fs/erofs/ishare.c | 10 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 43 ++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 3 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/sysfs/group.c | 7 +- fs/udf/super.c | 4 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 + include/asm-generic/codetag.lds.h | 2 +- include/linux/alloc_tag.h | 2 + include/linux/backing-file.h | 4 +- include/linux/damon.h | 2 + include/linux/device.h | 45 +++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 40 +-- include/linux/fs.h | 15 +- include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 7 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/security.h | 22 ++ include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- include/uapi/linux/landlock.h | 4 +- init/main.c | 1 - io_uring/io_uring.c | 4 + io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + io_uring/zcrx.c | 48 ++- io_uring/zcrx.h | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 112 ++++--- lib/tests/Makefile | 2 + lib/ts_kmp.c | 18 +- mm/damon/core.c | 101 +++--- mm/damon/stat.c | 5 +- mm/huge_memory.c | 15 +- mm/hugetlb.c | 3 + mm/internal.h | 42 ++- mm/memfd_luo.c | 7 +- mm/memory.c | 53 +-- mm/mempolicy.c | 23 +- mm/memremap.c | 2 +- mm/migrate.c | 17 + mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 28 +- mm/swapfile.c | 21 +- mm/util.c | 131 ++++---- mm/vma.c | 39 ++- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 79 ++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- scripts/module.lds.S | 14 +- security/apparmor/lsm.c | 16 +- security/apparmor/path.c | 8 +- security/landlock/cred.c | 6 +- security/landlock/syscalls.c | 14 +- security/lsm.h | 1 + security/lsm_init.c | 9 + security/security.c | 102 ++++++ security/selinux/hooks.c | 256 +++++++++++---- security/selinux/include/objsec.h | 11 + sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 ++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 35 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/util/Build | 1 - tools/perf/util/annotate-arch/annotate-loongarch.c | 1 + tools/perf/util/disasm.c | 2 +- tools/perf/util/disasm.h | 2 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 ++++-- tools/testing/selftests/landlock/audit_test.c | 357 +++++++++++++++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - tools/testing/selftests/landlock/tsync_test.c | 77 +++++ .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/include/dup.h | 7 +- tools/testing/vma/include/stubs.h | 13 +- 329 files changed, 4508 insertions(+), 2269 deletions(-)

1 week, 4 days

14
13
0 0

Incoming Mails on Hold for lkft-triage@lists.linaro.org

by Admin lists.linaro.org

Incoming Failed Messages The following messages have been quarantined by your administrator as inline attachment has exceeded server quota. You can view 5 new messages in your email quarantine below: Status Recipient Subject Date [1]Read lkft-triage(a)lists.linaro.org Proforma Invoice 5/5/2026 11:49:35 p.m. [2]Read lkft-triage(a)lists.linaro.org Payment Confirmation 5/5/2026 11:49:35 p.m. [3]Read lkft-triage(a)lists.linaro.org Export Requirements 5/5/2026 11:49:35 p.m. [4]Read All Thank you for your attention. (c) Powered by: IT lists.linaro.org Support. References 1. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 2. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 3. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 4. https://url1.io/rFtSx#lkft-triage@lists.linaro.org

1 week, 5 days

1
0
0 0

MWC Shanghai 2026 Contacts - 40% OFF!

by Aaron Daniel

Hi, We’re pleased to offer you exclusive access to the MWC Shanghai 2026 Visitor Contact List—a powerful resource to connect directly with key industry professionals. Event Recap:- Date: 24 - 26 Jun 2026 Registrants Counts: 45,754 Visitors Contacts Data Fields Available: Individual Email Address, Cell Phone Number, Contact Name, Job Title, Company Name, Website, Physical Address, LinkedIn Profile, and more. Get 40% off Reply Today! If you're interested, let me know and I’ll be happy to share the pricing details. Best regards, Aaron Daniel Sr. Marketing Manager If you do not wish to receive this newsletter reply “Not interested”

2 weeks, 2 days

1
0
0 0

[PATCH 6.12 00/35] 6.12.84-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.84 release. There are 35 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:21 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.84-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.84-rc1 Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Max Boone <mboone(a)akamai.com> mm/pagewalk: fix race between concurrent split and refault Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Miguel Ojeda <ojeda(a)kernel.org> rust: warn on bindgen < 0.69.5 and libclang >= 19.1 Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Steven Chen <chenste(a)linux.microsoft.com> ima: do not copy measurement list to kdump kernel Steven Chen <chenste(a)linux.microsoft.com> ima: verify if the segment size has changed Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation ------------- Diffstat: Makefile | 4 +- drivers/crypto/ccp/sev-dev.c | 19 ++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 +++++++------- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 +++++++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + drivers/net/wireless/ath/ath9k/channel.c | 6 +-- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 - drivers/pci/endpoint/functions/pci-epf-vntb.c | 18 +------ fs/f2fs/compress.c | 14 +++-- fs/f2fs/namei.c | 1 + fs/fuse/control.c | 4 +- fs/fuse/dev.c | 3 ++ fs/fuse/readdir.c | 4 ++ fs/ntfs3/fslog.c | 12 ++++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/smb2ops.c | 6 +++ fs/smb/server/mgmt/user_config.c | 6 --- fs/smb/server/smb2pdu.c | 2 + fs/smb/server/smbacl.c | 61 +++++++++++++++++----- fs/smb/server/transport_ipc.c | 16 ++++-- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 41 +++++++++++---- include/linux/hugetlb.h | 17 ++++++ include/net/mac80211.h | 4 +- mm/pagewalk.c | 24 ++++++++- mm/userfaultfd.c | 2 +- net/mac80211/tx.c | 4 +- net/packet/af_packet.c | 21 +++++--- net/rxrpc/conn_event.c | 14 ++++- net/rxrpc/key.c | 4 ++ scripts/dtc/dtc-lexer.l | 3 -- scripts/generate_rust_analyzer.py | 14 ++++- scripts/rust_is_available.sh | 15 ++++++ .../rust_is_available_bindgen_libclang_concat.h | 3 ++ scripts/rust_is_available_test.py | 34 +++++++++++- security/integrity/ima/ima_kexec.c | 13 +++++ sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 +++ 39 files changed, 389 insertions(+), 109 deletions(-)

2 weeks, 6 days

12
11
0 0

[PATCH 7.0 00/42] 7.0.2-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.2 release. There are 42 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.2-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.2-rc1 Naman Jain <namjain(a)linux.microsoft.com> mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Eric Naim <dnaim(a)cachyos.org> ALSA: hda/realtek: Add quirk for Legion S7 15IMH Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Jan Kara <jack(a)suse.cz> writeback: Fix use after free in inode_switch_wbs_work_fn() DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Paulo Alcantara <pc(a)manguebit.org> smb: client: fix dir separator in SMB1 UNIX mounts Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Miklos Szeredi <mszeredi(a)redhat.com> fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Miklos Szeredi <mszeredi(a)redhat.com> fuse: abort on fatal signal during sync init Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate owner of durable handle on reconnect Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Dudu Lu <phx0fer(a)gmail.com> crypto: krb5enc - fix async decrypt skipping hash verification Wesley Atwell <atwellwea(a)gmail.com> crypto: krb5enc - fix sleepable flag handling in encrypt dispatch Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Miguel Ojeda <ojeda(a)kernel.org> pwm: th1520: fix `CLIPPY=1` warning Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Fix src offset when decrypting in-place ------------- Diffstat: Makefile | 4 +- crypto/authencesn.c | 6 +- crypto/krb5enc.c | 51 ++++++++----- drivers/crypto/ccp/sev-dev.c | 19 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 +++++----- drivers/hv/mshv_vtl_main.c | 12 ++- drivers/pwm/pwm_th1520.rs | 5 +- fs/f2fs/compress.c | 14 +++- fs/f2fs/data.c | 7 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/namei.c | 1 + fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 ++- fs/fs-writeback.c | 36 ++++----- fs/fuse/control.c | 4 +- fs/fuse/dev.c | 30 +++++--- fs/fuse/fuse_i.h | 1 + fs/fuse/inode.c | 1 + fs/fuse/readdir.c | 4 + fs/ntfs3/fslog.c | 12 ++- fs/smb/client/cifsacl.c | 117 +++++++++++++++++++++-------- fs/smb/client/connect.c | 10 +-- fs/smb/client/smb1ops.c | 19 ++--- fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 5 +- fs/smb/server/mgmt/user_config.c | 6 -- fs/smb/server/mgmt/user_session.c | 8 +- fs/smb/server/oplock.c | 7 ++ fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/smbacl.c | 61 +++++++++++---- fs/smb/server/transport_ipc.c | 16 +++- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 128 +++++++++++++++++++++++++++----- fs/smb/server/vfs_cache.h | 12 ++- include/uapi/linux/mshv.h | 2 +- net/packet/af_packet.c | 21 ++++-- net/rxrpc/key.c | 4 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 14 +++- sound/hda/codecs/realtek/alc269.c | 1 + sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 ++ 43 files changed, 513 insertions(+), 213 deletions(-)

3 weeks

13
12
0 0

Verified DMEA Berlin 2026 Contacts + 40% Off

by Alyssa Morgan

Hi, Since your company exhibited at DMEA Berlin 2026, I wanted to check if you'd be interested in accessing the final attendee database containing 25,718 verified contacts. All contacts are opt-in, GDPR-compliant, and can be customized by job title, industry, company size, or region based on your target audience. Let me know your ideal prospects, and I’ll share the relevant counts and pricing. As the expo has now concluded, we’re offering an exclusive 40% discount on the full attendee list for a limited time. Best regards, Alyssa Morgan Sr. Demand Generation We hope you found this message to be useful. However, if you'd rather not receive future e-mails, please reply opt-out

3 weeks

1
0
0 0

[PATCH 6.18 00/55] 6.18.25-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.25 release. There are 55 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.25-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.25-rc1 Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Eric Naim <dnaim(a)cachyos.org> ALSA: hda/realtek: Add quirk for Legion S7 15IMH Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Jan Kara <jack(a)suse.cz> writeback: Fix use after free in inode_switch_wbs_work_fn() DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Miklos Szeredi <mszeredi(a)redhat.com> fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Miklos Szeredi <mszeredi(a)redhat.com> fuse: abort on fatal signal during sync init Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS Eric Biggers <ebiggers(a)kernel.org> kunit: configs: Enable all crypto library tests in all_tests.config Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Add a .kunitconfig file Eric Biggers <ebiggers(a)kernel.org> kunit: configs: Enable all CRC tests in all_tests.config Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Add a .kunitconfig file Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Peter Zijlstra <peterz(a)infradead.org> sched/debug: Fix avg_vruntime() usage Catalin Marinas <catalin.marinas(a)arm.com> arm64: errata: Work around early CME DVMSync acknowledgement Catalin Marinas <catalin.marinas(a)arm.com> arm64: cputype: Add C1-Pro definitions Catalin Marinas <catalin.marinas(a)arm.com> arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() Catalin Marinas <catalin.marinas(a)arm.com> arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate owner of durable handle on reconnect Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Dudu Lu <phx0fer(a)gmail.com> crypto: krb5enc - fix async decrypt skipping hash verification Wesley Atwell <atwellwea(a)gmail.com> crypto: krb5enc - fix sleepable flag handling in encrypt dispatch Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Fix src offset when decrypting in-place ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 2 + Makefile | 4 +- arch/arm64/Kconfig | 12 +++ arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/fpsimd.h | 21 ++++ arch/arm64/include/asm/tlbbatch.h | 10 +- arch/arm64/include/asm/tlbflush.h | 143 ++++++++++++++++++++++----- arch/arm64/kernel/cpu_errata.c | 30 ++++++ arch/arm64/kernel/entry-common.c | 3 + arch/arm64/kernel/fpsimd.c | 79 +++++++++++++++ arch/arm64/kernel/process.c | 36 +++++++ arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 8 +- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 10 +- arch/arm64/tools/cpucaps | 1 + crypto/authencesn.c | 6 +- crypto/krb5enc.c | 51 ++++++---- drivers/crypto/ccp/sev-dev.c | 19 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 ++++---- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 ++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 ++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + fs/f2fs/compress.c | 14 ++- fs/f2fs/data.c | 7 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/namei.c | 1 + fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 ++- fs/fs-writeback.c | 36 +++---- fs/fuse/control.c | 4 +- fs/fuse/dev.c | 30 +++--- fs/fuse/fuse_i.h | 1 + fs/fuse/inode.c | 1 + fs/fuse/readdir.c | 4 + fs/ntfs3/fslog.c | 12 ++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 5 +- fs/smb/server/mgmt/user_config.c | 6 -- fs/smb/server/mgmt/user_session.c | 7 +- fs/smb/server/oplock.c | 7 ++ fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/smbacl.c | 61 +++++++++--- fs/smb/server/transport_ipc.c | 16 ++- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 128 ++++++++++++++++++++---- fs/smb/server/vfs_cache.h | 12 ++- kernel/sched/debug.c | 4 +- lib/crc/.kunitconfig | 3 + lib/crc/Kconfig | 21 ++-- lib/crc/tests/crc_kunit.c | 28 ++++-- lib/crypto/.kunitconfig | 11 +++ lib/crypto/tests/Kconfig | 32 ++++-- net/ipv6/exthdrs.c | 4 + net/ipv6/seg6_hmac.c | 2 + net/packet/af_packet.c | 21 ++-- net/rxrpc/key.c | 4 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 14 ++- sound/hda/codecs/realtek/alc269.c | 1 + sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 ++ tools/testing/kunit/configs/all_tests.config | 4 + 67 files changed, 870 insertions(+), 218 deletions(-)

3 weeks, 1 day

12
11
0 0

[PATCH 6.6 000/166] 6.6.136-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.136 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:21 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.136-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.136-rc1 Yu Kuai <yukuai3(a)huawei.com> md/raid1: fix data lost for writemostly rdev Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Herbert Xu <herbert(a)gondor.apana.org.au> crypto: testmgr - Hide ENOENT errors better Herbert Xu <herbert(a)gondor.apana.org.au> crypto: testmgr - Hide ENOENT errors Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_{data_ready,write_space} Thomas Gleixner <tglx(a)kernel.org> i40e: Fix preempt count leak in napi poll tracepoint Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Yu Kuai <yukuai3(a)huawei.com> md/raid1,raid10: don't ignore IO flags Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Kenta Akagi <k(a)mgml.me> Revert "perf unwind-libdw: Fix invalid reference counts" Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Chaitanya Kulkarni <kch(a)nvidia.com> blktrace: fix __this_cpu_read/write in preemptible context Jakub Kicinski <kuba(a)kernel.org> nfc: nci: complete pending data exchange on device close Eric Dumazet <edumazet(a)google.com> net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() Eric Dumazet <edumazet(a)google.com> net: add proper RCU protection to /proc/net/ptype Maud Spierings <maudspierings(a)gocontroll.com> iio: common: st_sensors: Fix use of uninitialize device structs Qu Wenruo <wqu(a)suse.com> btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() Jiayuan Chen <jiayuan.chen(a)linux.dev> net: skb: fix cross-cache free of KFENCE-allocated skb head Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Aaron Plattner <aplattner(a)nvidia.com> objtool: Remove max symbol name length limitation Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 1 - arch/x86/include/uapi/asm/kvm.h | 12 +-- arch/x86/kvm/svm/sev.c | 11 ++- arch/x86/kvm/vmx/nested.c | 4 + arch/x86/kvm/vmx/vmx.c | 21 ------ arch/x86/kvm/x86.c | 24 +++--- crypto/algif_aead.c | 2 +- crypto/testmgr.c | 24 +++++- drivers/ata/ahci.c | 14 ++++ drivers/crypto/ccp/sev-dev.c | 19 ++++- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/i915/display/intel_psr.c | 18 +++-- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +++-- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +++- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/iio/accel/st_accel_core.c | 10 +-- drivers/iio/common/st_sensors/st_sensors_core.c | 36 +++++---- drivers/iio/common/st_sensors/st_sensors_trigger.c | 20 +++-- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/md/bcache/super.c | 7 ++ drivers/md/raid1.c | 6 +- drivers/md/raid10.c | 7 -- .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 +++ drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++------ drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +++- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++++++-- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_trace.h | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 ++- drivers/net/ethernet/intel/ixgbevf/vf.c | 7 ++ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 ++++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 ++++- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 ++- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 ++-- drivers/net/wireless/ath/ath9k/channel.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 ++ drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 - drivers/nfc/s3fwrn5/uart.c | 10 ++- drivers/pci/controller/pci-hyperv.c | 8 ++ drivers/pci/endpoint/functions/pci-epf-vntb.c | 19 +---- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++ drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 +++++++++++-- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 +++ drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 +++ drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/bio.c | 29 +++----- fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/f2fs/compress.c | 14 +++- fs/f2fs/namei.c | 1 + fs/fuse/control.c | 4 +- fs/fuse/dev.c | 3 + fs/fuse/readdir.c | 4 + fs/nilfs2/dat.c | 3 + fs/ntfs3/fslog.c | 12 ++- fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 31 ++++++++ fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +-- fs/ocfs2/resize.c | 10 ++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 9 ++- fs/smb/server/smbacl.c | 19 +++-- fs/smb/server/transport_tcp.c | 4 +- include/linux/kvm_host.h | 3 +- include/net/mac80211.h | 4 + include/net/netfilter/nf_tables.h | 2 + include/net/pkt_cls.h | 2 + include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 +++++- include/trace/events/btrfs.h | 11 ++- include/uapi/linux/kvm.h | 11 +-- kernel/trace/blktrace.c | 4 +- kernel/trace/trace_probe.c | 2 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/can/raw.c | 11 ++- net/core/net-procfs.c | 49 ++++++++---- net/core/skbuff.c | 5 +- net/core/skmsg.c | 14 ++-- net/ipv4/icmp.c | 7 ++ net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/exthdrs.c | 4 + net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/seg6_hmac.c | 2 + net/l2tp/l2tp_core.c | 5 ++ net/mac80211/tx.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 3 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nft_dynset.c | 10 ++- net/netfilter/nft_set_pipapo_avx2.c | 20 ++--- net/netfilter/xt_multiport.c | 34 ++++++++- net/nfc/digital_technology.c | 6 ++ net/nfc/llcp_core.c | 2 + net/nfc/nci/core.c | 9 +++ net/packet/af_packet.c | 21 ++++-- net/rxrpc/conn_event.c | 14 +++- net/rxrpc/key.c | 9 ++- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/em_cmp.c | 5 +- net/sched/em_nbyte.c | 2 + net/sched/em_text.c | 11 ++- net/unix/af_unix.c | 8 +- net/unix/diag.c | 21 ++++-- net/wireless/core.c | 4 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 +++++++- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 1 + scripts/checkpatch.pl | 10 +++ scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 17 ++++- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_realtek.c | 5 ++ sound/soc/amd/yc/acp6x-mach.c | 21 ++++++ sound/soc/qcom/qdsp6/q6apm.c | 14 +++- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +++-- sound/usb/caiaq/device.c | 4 +- sound/usb/format.c | 86 +++++++++++++++++++--- sound/usb/mixer.c | 7 ++ sound/usb/quirks.c | 2 + tools/objtool/elf.c | 14 ++-- tools/perf/util/unwind-libdw.c | 7 +- .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + 179 files changed, 1172 insertions(+), 450 deletions(-)

3 weeks, 1 day

11
10
0 0

[PATCH 6.19 000/220] 6.19.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.14 release. There are 220 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 22 Apr 2026 15:38:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.14-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.14-rc1 Leon Romanovsky <leon(a)kernel.org> dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output Leon Romanovsky <leon(a)kernel.org> dma-debug: Allow multiple invocations of overlapping entries Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Shardul Bankar <shardul.b(a)mpiricsoftware.com> wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix use-after-free on USB disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Linus Torvalds <torvalds(a)linux-foundation.org> x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Linus Torvalds <torvalds(a)linux-foundation.org> x86: rename and clean up __copy_from_user_inatomic_nocache() Linus Torvalds <torvalds(a)linux-foundation.org> x86-64: rename misleadingly named '__copy_user_nocache()' function Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Sean Christopherson <seanjc(a)google.com> KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test refinement of single-value tnum Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Sean Christopherson <seanjc(a)google.com> KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Sean Christopherson <seanjc(a)google.com> KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Sean Christopherson <seanjc(a)google.com> KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Handle invalid large leaf mappings correctly Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Reorganize the init to decouple migration from reset Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Alistair Popple <apopple(a)nvidia.com> selftests/mm: hmm-tests: don't hardcode THP size to 2MB Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Benjamin Berg <benjamin.berg(a)intel.com> scripts/gdb/symbols: handle module path parameters Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: don't call cdev_init while cdev in use Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Alexey Charkov <alchark(a)flipper.net> usb: typec: fusb302: Switch to threaded IRQ handler Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Stefan Metzmacher <metze(a)samba.org> smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() Stefan Metzmacher <metze(a)samba.org> smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> bnge: return after auxiliary_device_uninit() in error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl Thomas Gleixner <tglx(a)kernel.org> clockevents: Prevent timer interrupt starvation Peter Zijlstra <peterz(a)infradead.org> sched/deadline: Use revised wakeup rule for dl_server Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Douya Le <ldy3087146292(a)gmail.com> crypto: af_alg - limit RX SG extraction by receive buffer budget Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Li RongQing <lirongqing(a)baidu.com> devlink: Fix incorrect skb socket family dumping Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Justin Iurman <justin.iurman(a)gmail.com> net: ioam6: fix OOB and missing lock Felix Gu <ustc.gu(a)gmail.com> net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop Syed Saba Kareem <Syed.SabaKareem(a)amd.com> ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: SDCA: Unregister IRQ handlers on module remove Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SDCA: Fix overwritten var within for loop Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: make hash table per queue Scott Mitchell <scott.k.mitch1(a)gmail.com> netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Vinay Belgaumkar <vinay.belgaumkar(a)intel.com> drm/xe: Fix bug in idledly unit conversion Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards() Francesco Lavra <flavra(a)baylibre.com> pinctrl: mcp23s08: Disable all pin interrupts during probe Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Kotlyarov Mihail <mihailkotlyarow(a)gmail.com> xfrm: fix refcount leak in xfrm_migrate_policy_find Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Stefano Garzarella <sgarzare(a)redhat.com> vsock/test: fix send_buf()/recv_buf() EINTR handling Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ixgbe: stop re-reading flash on every get_drvinfo for e610 Kohei Enju <kohei(a)enjuk.jp> ice: ptp: don't WARN when controlling PF is unavailable Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SOF: Intel: fix iteration in is_endpoint_present() Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SOF: Intel: Fix endpoint index if endpoints are missing Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Fix errors in IRQ cleanup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Add ASoC jack hookup in class driver Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix infinite fault loop on permission-denied GPA intercepts Sahil Chandna <sahilchandna(a)linux.microsoft.com> PCI: hv: Fix double ida_free in hv_pci_probe error path Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Chris J Arges <carges(a)cloudflare.com> net: increase IP_TUNNEL_RECURSION_LIMIT to 5 Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump Nikolaos Gkarlis <nickgarlis(a)gmail.com> rtnetlink: add missing netlink_ns_capable() check for peer netns Zijing Yin <yzjaurora(a)gmail.com> bridge: guard local VLAN-0 FDB helpers against NULL vlan group Eric Dumazet <edumazet(a)google.com> ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Fix memory leak in airoha_qdma_rx_process() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Arnd Bergmann <arnd(a)arndb.de> net: fec: make FIXED_PHY dependency unconditional Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D NeilBrown <neilb(a)ownmail.net> cachefiles: fix incorrect dentry refcount in cachefiles_cull() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement Michael S. Tsirkin <mst(a)redhat.com> dma-debug: track cache clean flag in entries Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN Keenan Dong <keenanat2000(a)gmail.com> xfrm: account XFRMA_IF_ID in aevent size calculation Maximilian Pezzullo <maximilianpezzullo(a)gmail.com> HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Mihai Sain <mihai.sain(a)microchip.com> ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB Felix Gu <ustc.gu(a)gmail.com> soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind Felix Gu <ustc.gu(a)gmail.com> soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix delimiter bug in print functions Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Reserve full Gunyah metadata region Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix --show/--hide for individual cpuidle counters Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix incorrect format variable Serhii Pievniev <spevnev16(a)gmail.com> tools/power/turbostat: Fix microcode patch level output for AMD/Hygon Len Brown <len.brown(a)intel.com> tools/power turbostat: Fix swidle header vs data display Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Fix UART10 pinconf Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx93-tqma9352: improve eMMC pad configuration Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx91-tqma9131: improve eMMC pad configuration Luke Wang <ziniu.wang_1(a)nxp.com> arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Ravi Hothi <ravi.hothi(a)oss.qualcomm.com> arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity Daniel J Blueman <daniel(a)quora.org> arm64: dts: qcom: hamoa/x1: fix idle exit latency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock John Pavlick <jspavlick(a)posteo.net> net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Even Xu <even.xu(a)intel.com> HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Alexander Savenko <alex.sav4387(a)gmail.com> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Donet Tom <donettom(a)linux.ibm.com> drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10 Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry Kshamendra Kumar Mishra <kshamendrakumarmishra(a)gmail.com> ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk Joel Fernandes <joelagnelf(a)nvidia.com> srcu: Use irq_work to start GP in tiny SRCU Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Handle GPU page faults correctly on non-4K page systems Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76) Filipe Manana <fdmanana(a)suse.com> btrfs: fix zero size inode with non-zero size after log replay Matthew Schwartz <matthew.schwartz(a)linux.dev> platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC Frank Zhang <rmxpzlb(a)gmail.com> ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies Hasun Park <hasunpark(a)gmail.com> ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: hci_sync: annotate data-races around hdev->req_status Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10 Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx91-tqma9131.dtsi | 20 +- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 26 +-- arch/arm64/boot/dts/qcom/hamoa.dtsi | 2 +- arch/arm64/boot/dts/qcom/monaco.dtsi | 9 +- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 2 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 +- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/kvm/guest.c | 4 +- arch/arm64/mm/mmu.c | 4 + arch/arm64/mm/pageattr.c | 50 ++--- arch/arm64/mm/trans_pgd.c | 42 +--- arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 2 +- arch/mips/kvm/mips.c | 4 +- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/kvm/book3s.c | 4 +- arch/powerpc/kvm/booke.c | 4 +- arch/powerpc/lib/pmem.c | 11 +- arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 2 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +- arch/x86/include/asm/uaccess_64.h | 16 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kernel/shstk.c | 3 +- arch/x86/kvm/svm/sev.c | 46 +++-- arch/x86/kvm/x86.c | 18 +- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +- arch/x86/lib/usercopy_64.c | 12 +- crypto/af_alg.c | 6 +- crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 5 + drivers/ata/ahci.c | 14 ++ drivers/dma/idxd/device.c | 17 +- drivers/dma/idxd/init.c | 10 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 7 +- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 + .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 + drivers/hv/mshv_root_main.c | 15 +- drivers/hwmon/powerz.c | 8 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/infiniband/sw/rdmavt/qp.c | 8 +- drivers/md/bcache/super.c | 7 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 + .../media/platform/rockchip/rkvdec/rkvdec-vp9.c | 3 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++--- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 1 + drivers/net/ethernet/freescale/Kconfig | 2 +- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 8 +- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +- drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +- drivers/net/phy/sfp.c | 16 ++ drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireguard/device.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/controller/pci-hyperv.c | 12 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/pinctrl-mcp23s08.c | 9 + drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/asus-nb-wmi.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/microchip/mpfs-control-scb.c | 6 +- drivers/soc/microchip/mpfs-mss-top-sysreg.c | 6 +- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++ drivers/vfio/pci/xe/main.c | 43 +++-- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/tree-log.c | 98 ++++++---- fs/cachefiles/namei.c | 5 + fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 35 +++- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 10 +- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 20 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 + fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 +- include/hyperv/hvgdk_mini.h | 6 + include/hyperv/hvhdk.h | 4 +- include/linux/clockchips.h | 2 + include/linux/dma-mapping.h | 7 + include/linux/hugetlb.h | 17 ++ include/linux/kvm_host.h | 93 +++++---- include/linux/mmap_lock.h | 6 +- include/linux/soc/qcom/pdr.h | 1 + include/linux/srcutiny.h | 4 + include/linux/uaccess.h | 11 +- include/net/ip_tunnels.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_queue.h | 1 - include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 ++- include/sound/sdca_interrupts.h | 5 + include/trace/events/btrfs.h | 11 +- include/trace/events/dma.h | 3 +- include/uapi/linux/kvm.h | 19 +- kernel/dma/debug.c | 35 +++- kernel/rcu/srcutiny.c | 19 +- kernel/sched/deadline.c | 2 +- kernel/time/clockevents.c | 27 ++- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + kernel/trace/trace_probe.c | 2 +- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/filemap.c | 3 +- mm/internal.h | 1 - mm/kasan/init.c | 8 +- mm/truncate.c | 6 +- mm/userfaultfd.c | 2 +- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 +- net/bridge/br_fdb.c | 6 + net/can/raw.c | 11 +- net/core/rtnetlink.c | 40 ++-- net/devlink/health.c | 2 +- net/ipv4/icmp.c | 7 + net/ipv4/nexthop.c | 41 ++-- net/ipv6/ioam6.c | 33 ++-- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/key/af_key.c | 52 +++-- net/l2tp/l2tp_core.c | 5 + net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_netlink.c | 28 ++- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_queue.c | 214 ++++++++------------- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_multiport.c | 34 +++- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/sched/act_csum.c | 6 +- net/unix/diag.c | 21 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 ++- net/xfrm/xfrm_policy.c | 5 +- net/xfrm/xfrm_user.c | 11 +- scripts/checkpatch.pl | 10 + scripts/gdb/linux/symbols.py | 2 +- scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/hda/codecs/realtek/alc269.c | 35 +++- sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 +- sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/intel/avs/board_selection.c | 9 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +- sound/soc/sdca/sdca_class_function.c | 30 +++ sound/soc/sdca/sdca_interrupts.c | 80 +++++++- sound/soc/soc-core.c | 1 + sound/soc/sof/intel/hda.c | 10 +- sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/Kconfig | 1 + sound/usb/quirks.c | 2 + sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- tools/power/x86/turbostat/turbostat.c | 67 ++++--- .../testing/selftests/bpf/progs/verifier_bounds.c | 137 +++++++++++++ .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - tools/testing/selftests/mm/hmm-tests.c | 83 ++------ .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + tools/testing/vsock/util.c | 8 +- virt/kvm/binary_stats.c | 2 +- virt/kvm/kvm_main.c | 20 +- 245 files changed, 1954 insertions(+), 958 deletions(-)

3 weeks, 4 days

12
11
0 0

[PATCH 6.18 000/198] 6.18.24-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.24 release. There are 198 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 22 Apr 2026 15:38:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.24-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.24-rc1 Leon Romanovsky <leon(a)kernel.org> dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output Leon Romanovsky <leon(a)kernel.org> dma-debug: Allow multiple invocations of overlapping entries Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Shardul Bankar <shardul.b(a)mpiricsoftware.com> wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix use-after-free on USB disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Linus Torvalds <torvalds(a)linux-foundation.org> x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Linus Torvalds <torvalds(a)linux-foundation.org> x86: rename and clean up __copy_from_user_inatomic_nocache() Linus Torvalds <torvalds(a)linux-foundation.org> x86-64: rename misleadingly named '__copy_user_nocache()' function Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Sean Christopherson <seanjc(a)google.com> KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test refinement of single-value tnum Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Sean Christopherson <seanjc(a)google.com> KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Sean Christopherson <seanjc(a)google.com> KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Sean Christopherson <seanjc(a)google.com> KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Handle invalid large leaf mappings correctly Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: don't call cdev_init while cdev in use Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Alexey Charkov <alchark(a)flipper.net> usb: typec: fusb302: Switch to threaded IRQ handler Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Stefan Metzmacher <metze(a)samba.org> smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() Stefan Metzmacher <metze(a)samba.org> smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl Thomas Gleixner <tglx(a)kernel.org> clockevents: Prevent timer interrupt starvation Peter Zijlstra <peterz(a)infradead.org> sched/deadline: Use revised wakeup rule for dl_server Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Douya Le <ldy3087146292(a)gmail.com> crypto: af_alg - limit RX SG extraction by receive buffer budget Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Li RongQing <lirongqing(a)baidu.com> devlink: Fix incorrect skb socket family dumping Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Justin Iurman <justin.iurman(a)gmail.com> net: ioam6: fix OOB and missing lock Felix Gu <ustc.gu(a)gmail.com> net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop Syed Saba Kareem <Syed.SabaKareem(a)amd.com> ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SDCA: Fix overwritten var within for loop Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: make hash table per queue Scott Mitchell <scott.k.mitch1(a)gmail.com> netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Vinay Belgaumkar <vinay.belgaumkar(a)intel.com> drm/xe: Fix bug in idledly unit conversion Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Kotlyarov Mihail <mihailkotlyarow(a)gmail.com> xfrm: fix refcount leak in xfrm_migrate_policy_find Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ixgbe: stop re-reading flash on every get_drvinfo for e610 Kohei Enju <kohei(a)enjuk.jp> ice: ptp: don't WARN when controlling PF is unavailable Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Chris J Arges <carges(a)cloudflare.com> net: increase IP_TUNNEL_RECURSION_LIMIT to 5 Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump Nikolaos Gkarlis <nickgarlis(a)gmail.com> rtnetlink: add missing netlink_ns_capable() check for peer netns Zijing Yin <yzjaurora(a)gmail.com> bridge: guard local VLAN-0 FDB helpers against NULL vlan group Eric Dumazet <edumazet(a)google.com> ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Fix memory leak in airoha_qdma_rx_process() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement Michael S. Tsirkin <mst(a)redhat.com> dma-debug: track cache clean flag in entries Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN Keenan Dong <keenanat2000(a)gmail.com> xfrm: account XFRMA_IF_ID in aevent size calculation Maximilian Pezzullo <maximilianpezzullo(a)gmail.com> HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Mihai Sain <mihai.sain(a)microchip.com> ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Reserve full Gunyah metadata region Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix --show/--hide for individual cpuidle counters Serhii Pievniev <spevnev16(a)gmail.com> tools/power/turbostat: Fix microcode patch level output for AMD/Hygon Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Fix UART10 pinconf Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx93-tqma9352: improve eMMC pad configuration Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx91-tqma9131: improve eMMC pad configuration Luke Wang <ziniu.wang_1(a)nxp.com> arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Ravi Hothi <ravi.hothi(a)oss.qualcomm.com> arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity Daniel J Blueman <daniel(a)quora.org> arm64: dts: qcom: hamoa/x1: fix idle exit latency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock John Pavlick <jspavlick(a)posteo.net> net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Even Xu <even.xu(a)intel.com> HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Alexander Savenko <alex.sav4387(a)gmail.com> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Donet Tom <donettom(a)linux.ibm.com> drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10 Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry Kshamendra Kumar Mishra <kshamendrakumarmishra(a)gmail.com> ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk Joel Fernandes <joelagnelf(a)nvidia.com> srcu: Use irq_work to start GP in tiny SRCU Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Handle GPU page faults correctly on non-4K page systems Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76) Filipe Manana <fdmanana(a)suse.com> btrfs: fix zero size inode with non-zero size after log replay Matthew Schwartz <matthew.schwartz(a)linux.dev> platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC Frank Zhang <rmxpzlb(a)gmail.com> ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies Hasun Park <hasunpark(a)gmail.com> ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: hci_sync: annotate data-races around hdev->req_status Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10 Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx91-tqma9131.dtsi | 20 +- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 26 +-- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 2 +- arch/arm64/boot/dts/qcom/qcs8300.dtsi | 9 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 +- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/kvm/guest.c | 4 +- arch/arm64/mm/mmu.c | 4 + arch/arm64/mm/pageattr.c | 50 ++--- arch/arm64/mm/trans_pgd.c | 42 +--- arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 2 +- arch/mips/kvm/mips.c | 4 +- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/kvm/book3s.c | 4 +- arch/powerpc/kvm/booke.c | 4 +- arch/powerpc/lib/pmem.c | 11 +- arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 2 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +- arch/x86/include/asm/uaccess_64.h | 16 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kernel/shstk.c | 3 +- arch/x86/kvm/svm/sev.c | 46 +++-- arch/x86/kvm/x86.c | 18 +- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +- arch/x86/lib/usercopy_64.c | 12 +- crypto/af_alg.c | 6 +- crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 5 + drivers/ata/ahci.c | 14 ++ drivers/dma/idxd/device.c | 17 +- drivers/dma/idxd/init.c | 10 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 7 +- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 + .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 + drivers/hwmon/powerz.c | 8 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/infiniband/sw/rdmavt/qp.c | 8 +- drivers/md/bcache/super.c | 7 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 + .../media/platform/rockchip/rkvdec/rkvdec-vp9.c | 3 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++--- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 8 +- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +- drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +- drivers/net/phy/sfp.c | 16 ++ drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireguard/device.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/asus-nb-wmi.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++ drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/tree-log.c | 98 ++++++---- fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 31 +++ fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 10 +- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 20 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 + fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 +- include/linux/clockchips.h | 2 + include/linux/dma-mapping.h | 7 + include/linux/hugetlb.h | 17 ++ include/linux/kvm_host.h | 93 +++++---- include/linux/mmap_lock.h | 6 +- include/linux/soc/qcom/pdr.h | 1 + include/linux/srcutiny.h | 4 + include/linux/uaccess.h | 11 +- include/net/ip_tunnels.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_queue.h | 1 - include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 ++- include/trace/events/btrfs.h | 11 +- include/trace/events/dma.h | 3 +- include/uapi/linux/kvm.h | 19 +- kernel/dma/debug.c | 35 +++- kernel/rcu/srcutiny.c | 19 +- kernel/sched/deadline.c | 2 +- kernel/time/clockevents.c | 27 ++- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + kernel/trace/trace_probe.c | 2 +- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- mm/userfaultfd.c | 2 +- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 +- net/bridge/br_fdb.c | 6 + net/can/raw.c | 11 +- net/core/rtnetlink.c | 40 ++-- net/devlink/health.c | 2 +- net/ipv4/icmp.c | 7 + net/ipv4/nexthop.c | 41 ++-- net/ipv6/ioam6.c | 33 ++-- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/l2tp/l2tp_core.c | 5 + net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_netlink.c | 30 ++- net/netfilter/nf_conntrack_proto_sctp.c | 3 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_queue.c | 214 ++++++++------------- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_multiport.c | 34 +++- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/sched/act_csum.c | 6 +- net/unix/diag.c | 21 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 ++- net/xfrm/xfrm_policy.c | 5 +- net/xfrm/xfrm_user.c | 11 +- scripts/checkpatch.pl | 10 + scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/hda/codecs/realtek/alc269.c | 13 ++ sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 +- sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/intel/avs/board_selection.c | 9 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +- sound/soc/sdca/sdca_interrupts.c | 4 +- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/Kconfig | 1 + sound/usb/quirks.c | 2 + sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- tools/power/x86/turbostat/turbostat.c | 44 +++-- .../testing/selftests/bpf/progs/verifier_bounds.c | 137 +++++++++++++ .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + virt/kvm/binary_stats.c | 2 +- virt/kvm/kvm_main.c | 20 +- 224 files changed, 1675 insertions(+), 802 deletions(-)

3 weeks, 5 days

13
13
0 0

[PATCH 7.0 00/76] 7.0.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.1 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 22 Apr 2026 15:38:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.1-rc1 Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Shardul Bankar <shardul.b(a)mpiricsoftware.com> wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix use-after-free on USB disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Linus Torvalds <torvalds(a)linux-foundation.org> x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Linus Torvalds <torvalds(a)linux-foundation.org> x86: rename and clean up __copy_from_user_inatomic_nocache() Linus Torvalds <torvalds(a)linux-foundation.org> x86-64: rename misleadingly named '__copy_user_nocache()' function Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Sean Christopherson <seanjc(a)google.com> KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Sean Christopherson <seanjc(a)google.com> KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Sean Christopherson <seanjc(a)google.com> KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Handle invalid large leaf mappings correctly Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Reorganize the init to decouple migration from reset Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/lru_sort: warn commit_inputs vs param updates race SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Alistair Popple <apopple(a)nvidia.com> selftests/mm: hmm-tests: don't hardcode THP size to 2MB Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Benjamin Berg <benjamin.berg(a)intel.com> scripts/gdb/symbols: handle module path parameters Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: don't call cdev_init while cdev in use Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Alexey Charkov <alchark(a)flipper.net> usb: typec: fusb302: Switch to threaded IRQ handler Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Stefan Metzmacher <metze(a)samba.org> smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() Stefan Metzmacher <metze(a)samba.org> smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> bnge: return after auxiliary_device_uninit() in error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU: Fix FPDSS on Zen1 Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks ------------- Diffstat: Documentation/admin-guide/mm/damon/lru_sort.rst | 4 ++ Documentation/admin-guide/mm/damon/reclaim.rst | 4 ++ Makefile | 4 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 ++- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/mm/mmu.c | 4 ++ arch/arm64/mm/pageattr.c | 50 +++++++------ arch/arm64/mm/trans_pgd.c | 42 ++--------- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/lib/pmem.c | 11 +-- arch/x86/include/asm/msr-index.h | 3 + arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +-- arch/x86/include/asm/uaccess_64.h | 16 +++-- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/svm/sev.c | 46 ++++++++---- arch/x86/kvm/x86.c | 14 +++- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +-- arch/x86/lib/usercopy_64.c | 12 ++-- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++-- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hwmon/powerz.c | 8 ++- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/sw/rdmavt/qp.c | 8 +-- drivers/md/bcache/super.c | 7 ++ .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 +++ drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++ drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++------- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 ++-- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 1 + drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wireguard/device.c | 8 +-- drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +----- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++++++++++-- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 ++-- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 +++ drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++++ drivers/vfio/pci/xe/main.c | 43 ++++++----- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/dcache.c | 4 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 ++- fs/ocfs2/resize.c | 10 ++- fs/smb/client/smb2file.c | 20 +++--- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 +++ fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 ++- include/linux/hugetlb.h | 17 +++++ include/linux/kvm_host.h | 10 ++- include/linux/uaccess.h | 11 ++- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/filemap.c | 3 +- mm/internal.h | 1 - mm/kasan/init.c | 8 +-- mm/truncate.c | 6 +- mm/userfaultfd.c | 2 +- net/can/raw.c | 11 ++- net/nfc/digital_technology.c | 6 ++ net/nfc/llcp_core.c | 2 + scripts/checkpatch.pl | 10 +++ scripts/gdb/linux/symbols.py | 2 +- scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +++- sound/usb/6fire/chip.c | 17 +++-- sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - tools/testing/selftests/mm/hmm-tests.c | 83 +++++----------------- 97 files changed, 579 insertions(+), 358 deletions(-)

3 weeks, 5 days

13
12
0 0

売上28倍。AI時代の新・集客術

by 株式会社アセット

事業オーナー様へ今、店舗経営の現場で「静かな、しかし劇的な変化」が起きていることにお気づきでしょうか。実は、ユーザーの99.4％がGoogleマップを利用し、 ”近くの〇〇”とAIに相談してお店を決めているのです。つまり、「AIやマップに認識されない」ということは、新規客の60%にとって「存在しない店」と同じなのです。このような機会損失を避けたい方へ、 80,000店舗以上の実績から導き出した集客ノウハウを無料提供しております。｜―――――――――――――――――――――――― ｜｜　　　　Googleビジネスプロフィール｜　　　　「集客の基本」解析BOOK ｜｜　　　　　＜資料はこちら＞｜　　　　https://assetcorp.jp/26/ ｜｜―――――――――――――――――――――――― 本書では、80,000店舗以上の実績から導き出した「選ばれるお店」の勝ち筋を、3ステップにまとめています。資料を手がかりにして、GoogleマップとAIを掛け合わせ「自動運用」を始めた、あるネイルサロンではわずか4ヶ月で以下の成果を叩き出しました。検索表示回数： 113倍マップ閲覧数： 3倍売上実績： 28倍UP 「今の集客に限界を感じている」「集客基盤を築きたい」そう願うオーナー様にとって、この資料が現状を打破するきっかけになれば嬉しいです。ぜひこの機会にダウンロードしてご活用ください。 [資料ダウンロードURL]　https://assetcorp.jp/26/ ------------------------------------------ 　株式会社アセット　東京都豊島区南池袋2-30-11 　TEL：03-5256-7570 ------------------------------------------ 　本情報が不必要な方にはご迷惑をおかけし申し訳ございません。　配信ストップは下記にて承っております。　https://assetcorp.jp/mail/ 　お手数お掛けしますがよろしくお願いします。

3 weeks, 5 days

1
0
0 0

[PATCH 6.12 000/162] 6.12.83-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.83 release. There are 162 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 22 Apr 2026 15:38:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.83-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.83-rc1 John Hancock <john(a)kernel.doghat.io> PCI: Revert "Enable ACS after configuring IOMMU for OF platforms" Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Lukas Wunner <lukas(a)wunner.de> PCI: Fix placement of pci_save_state() in pci_bus_add_device() David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix use-after-free on USB disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Linus Torvalds <torvalds(a)linux-foundation.org> x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Linus Torvalds <torvalds(a)linux-foundation.org> x86: rename and clean up __copy_from_user_inatomic_nocache() Linus Torvalds <torvalds(a)linux-foundation.org> x86-64: rename misleadingly named '__copy_user_nocache()' function Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Sean Christopherson <seanjc(a)google.com> KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay Liam R. Howlett <Liam.Howlett(a)Oracle.com> kernel: be more careful about dup_mmap() failures and uprobe registering Eric Dumazet <edumazet(a)google.com> net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() Paweł Narewski <pawel.narewski(a)nokia.com> gpiolib: fix race condition for gdev->srcu Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> gpiolib: unify two loops initializing GPIO descriptors Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Sean Christopherson <seanjc(a)google.com> KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: don't call cdev_init while cdev in use Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Address thermal zone removal races with resume Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Mark thermal zones as exiting before unregistration Sasha Levin <sashal(a)kernel.org> Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" Sasha Levin <sashal(a)kernel.org> Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Thomas Gleixner <tglx(a)kernel.org> clockevents: Prevent timer interrupt starvation Peter Zijlstra <peterz(a)infradead.org> sched/deadline: Use revised wakeup rule for dl_server Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Douya Le <ldy3087146292(a)gmail.com> crypto: af_alg - limit RX SG extraction by receive buffer budget Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: make hash table per queue Scott Mitchell <scott.k.mitch1(a)gmail.com> netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Kotlyarov Mihail <mihailkotlyarow(a)gmail.com> xfrm: fix refcount leak in xfrm_migrate_policy_find Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Chris J Arges <carges(a)cloudflare.com> net: increase IP_TUNNEL_RECURSION_LIMIT to 5 Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Keenan Dong <keenanat2000(a)gmail.com> xfrm: account XFRMA_IF_ID in aevent size calculation Maximilian Pezzullo <maximilianpezzullo(a)gmail.com> HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Serhii Pievniev <spevnev16(a)gmail.com> tools/power/turbostat: Fix microcode patch level output for AMD/Hygon Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx93-tqma9352: improve eMMC pad configuration Luke Wang <ziniu.wang_1(a)nxp.com> arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Daniel J Blueman <daniel(a)quora.org> arm64: dts: qcom: hamoa/x1: fix idle exit latency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J John Pavlick <jspavlick(a)posteo.net> net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Alexander Savenko <alex.sav4387(a)gmail.com> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry Joel Fernandes <joelagnelf(a)nvidia.com> srcu: Use irq_work to start GP in tiny SRCU Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Handle GPU page faults correctly on non-4K page systems César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Matthew Schwartz <matthew.schwartz(a)linux.dev> platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: hci_sync: annotate data-races around hdev->req_status Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 26 +-- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/kvm/guest.c | 4 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 2 +- arch/mips/kvm/mips.c | 4 +- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/kvm/book3s.c | 4 +- arch/powerpc/kvm/booke.c | 4 +- arch/powerpc/lib/pmem.c | 11 +- arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 2 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +- arch/x86/include/asm/uaccess_64.h | 16 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kvm/svm/sev.c | 24 ++- arch/x86/kvm/x86.c | 18 +- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +- arch/x86/lib/usercopy_64.c | 12 +- crypto/af_alg.c | 2 + crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 5 + drivers/ata/ahci.c | 14 ++ drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib.c | 43 ++--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/xe/xe_mmio.c | 135 ++++++------- drivers/gpu/drm/xe/xe_mmio.h | 72 ++----- drivers/gpu/drm/xe/xe_trace.h | 7 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + drivers/hwmon/powerz.c | 8 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/infiniband/sw/rdmavt/qp.c | 8 +- drivers/md/bcache/super.c | 7 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++--- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 15 +- drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +- drivers/net/phy/sfp.c | 16 ++ drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/bus.c | 6 +- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 + drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/asus-nb-wmi.c | 2 +- drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/thermal/thermal_core.c | 36 +++- drivers/thermal/thermal_core.h | 1 + drivers/usb/class/cdc-acm.c | 53 ++++- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 ++ drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 31 +++ fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 10 +- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2inode.c | 2 +- fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- include/linux/clockchips.h | 2 + include/linux/kvm_host.h | 93 +++++---- include/linux/soc/qcom/pdr.h | 1 + include/linux/srcutiny.h | 4 + include/linux/uaccess.h | 11 +- include/net/ip_tunnels.h | 2 +- include/net/netfilter/nf_queue.h | 1 - include/net/pkt_cls.h | 2 + include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 ++- include/trace/events/btrfs.h | 11 +- include/uapi/linux/kvm.h | 19 +- kernel/events/uprobes.c | 4 + kernel/fork.c | 17 +- kernel/rcu/srcutiny.c | 19 +- kernel/sched/deadline.c | 2 +- kernel/time/clockevents.c | 27 ++- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + kernel/trace/trace_probe.c | 2 +- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 +- net/can/raw.c | 11 +- net/ipv4/icmp.c | 7 + net/ipv4/nexthop.c | 41 ++-- net/ipv6/exthdrs.c | 4 + net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/seg6_hmac.c | 2 + net/l2tp/l2tp_core.c | 5 + net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 3 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_queue.c | 214 ++++++++------------- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_multiport.c | 34 +++- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/rxrpc/key.c | 5 +- net/sched/act_csum.c | 6 +- net/sched/em_cmp.c | 5 +- net/sched/em_nbyte.c | 2 + net/sched/em_text.c | 11 +- net/unix/diag.c | 21 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 ++- net/xfrm/xfrm_policy.c | 5 +- net/xfrm/xfrm_user.c | 11 +- scripts/checkpatch.pl | 10 + scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_realtek.c | 10 + sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/qcom/qdsp6/q6apm.c | 14 +- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/format.c | 86 +++++++-- sound/usb/quirks.c | 2 + tools/objtool/check.c | 2 +- tools/power/x86/turbostat/turbostat.c | 9 +- .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + virt/kvm/binary_stats.c | 2 +- virt/kvm/kvm_main.c | 20 +- 195 files changed, 1379 insertions(+), 736 deletions(-)

3 weeks, 5 days

13
12
0 0

プログラミング教育で、新規事業

by 石嶋紗季

　新しい事業をお考えの方向けに、　日本の将来を担う、こども教育にたずさわる　事業パートナー募集のオンライン説明会を　ご視聴頂きたく、ご連絡いたしました。　　本事業は9割以上、異業種から新規参入されており　「未経験」「社員1名」でスタート可能です。　　本業はそのままに、収益づくりをお考えの方はぜひご視聴ください。 ----------------------------------------------------------- 　　　不況に強く、少子化でも成長する　　　プログラミング教育×個別指導　― 地域に"初"のハイブリッド型学習塾を ― 　　日時：4月23日（木）14：00〜15：00　※残り2枠　形式：オンライン開催　提供：エイチ・エム・グループ　　　　　　＜ご視聴はこちら＞　　　　https://wam-edu-fc.jp/wam2/ ----------------------------------------------------------- 　　　『少子化なのに、教育事業？』と、思うかもしれませんが　　実は、教育無償化などの国策もあり、子ども一人にかける　教育費の増加に伴い、市場は成長し続けています。　　また、教育費は不況時でも削減されにくいため　コロナ下でも大きく落ち込むことなく底堅さを見せました。　　そんな教育業界の中でも、プログラミング（IT教育）は　小学校で必修化されたため、保護者の関心が非常に高まっています。　　　そこで今回ご紹介するのが、全国300校舎、継続率97.6％を誇る　ハイブリッド教育事業「個別指導WAM」です。　　サイバーエージェント社開発の教材を活用した　「プログラミング×個別指導」という　他塾にはない独自の教育事業を提供しています。　いったい、教育市場にどのようなビジネスチャンスがあるのか？　オンラインセミナーで分かりやすく丁寧に　お伝えしますので、ぜひご視聴ください。　　　　　　　＜ご視聴はこちら＞　　　　https://wam-edu-fc.jp/wam2/ 　　 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 　教育事業FCセミナー事務局　電話：0120-889-859 　住所：東京都中央区銀座7-13-6 ――――――――――――――――――――――――――――――― 　本メールのご不要な方には大変ご迷惑をおかけいたしました。　今後ご案内が不要な方は下記URLよりお手続きをお願いいたします。　┗　https://wam-edu-fc.jp/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3 weeks, 6 days

1
0
0 0

[PATCH 6.1 00/55] 6.1.169-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.169 release. There are 55 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.169-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.169-rc1 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: Update the list of the PCI supported devices Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Borislav Petkov (AMD) <bp(a)alien8.de> EDAC/mc: Fix error path ordering in edac_mc_alloc() Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Lin.Cao <lincao12(a)amd.com> drm/scheduler: signal scheduled fence when kill job Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Johannes Berg <johannes.berg(a)intel.com> net: rfkill: reduce data->mtx scope in rfkill_fop_open Johannes Berg <johannes.berg(a)intel.com> rfkill: sync before userspace visibility/changes Bo Liu <liubo03(a)inspur.com> rfkill: Use sysfs_emit() to instead of sprintf() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Evaluate _REG outside the EC scope more carefully Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPICA: Add a depth argument to acpi_execute_reg_methods() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "ACPI: EC: Evaluate orphan _REG under EC device" Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop John Johansen <john.johansen(a)canonical.com> apparmor: fix race between freeing data and fs accessing it John Johansen <john.johansen(a)canonical.com> apparmor: fix race on rawdata dereference John Johansen <john.johansen(a)canonical.com> apparmor: fix differential encoding verification John Johansen <john.johansen(a)canonical.com> apparmor: fix unprivileged local user can do privileged policy management John Johansen <john.johansen(a)canonical.com> apparmor: Fix double free of ns_name in aa_replace_profiles() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix side-effect bug in match_char() macro usage John Johansen <john.johansen(a)canonical.com> apparmor: fix: limit the number of levels of policy namespaces Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: replace recursive profile removal with iterative approach Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix memory leak in verify_header Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: validate DFA start states are in bounds in unpack_pdb Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope ------------- Diffstat: Makefile | 4 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- drivers/acpi/acpica/acevents.h | 6 +- drivers/acpi/acpica/evregion.c | 12 +- drivers/acpi/acpica/evxfregn.c | 64 +---- drivers/acpi/ec.c | 14 +- drivers/acpi/internal.h | 1 + drivers/acpi/scan.c | 2 + drivers/edac/edac_mc.c | 6 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/gpu/drm/scheduler/sched_entity.c | 1 + drivers/input/misc/uinput.c | 35 ++- drivers/media/usb/uvc/uvc_driver.c | 88 +++++-- drivers/media/usb/uvc/uvcvideo.h | 2 + drivers/mmc/host/vub300.c | 2 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/usb/gadget/function/f_hid.c | 11 +- drivers/usb/gadget/function/u_ether.c | 8 +- include/acpi/acpixf.h | 5 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + lib/crypto/chacha.c | 4 + net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/ipv6/seg6_iptunnel.c | 41 ++- net/mptcp/pm_netlink.c | 24 +- net/mptcp/protocol.c | 2 + net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_set_pipapo.c | 20 +- net/rfkill/core.c | 84 ++++-- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/key.c | 2 +- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/xfrm/xfrm_user.c | 3 + security/apparmor/apparmorfs.c | 228 ++++++++++------- security/apparmor/include/label.h | 16 +- security/apparmor/include/lib.h | 12 + security/apparmor/include/match.h | 1 + security/apparmor/include/policy.h | 13 +- security/apparmor/include/policy_ns.h | 2 + security/apparmor/include/policy_unpack.h | 83 +++--- security/apparmor/label.c | 12 +- security/apparmor/match.c | 58 +++-- security/apparmor/policy.c | 82 +++++- security/apparmor/policy_ns.c | 2 + security/apparmor/policy_unpack.c | 74 ++++-- 65 files changed, 989 insertions(+), 498 deletions(-)

4 weeks

14
14
0 0

[PATCH 6.12 00/70] 6.12.82-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.82-rc1 Aaron Erhardt <aer(a)tuxedocomputers.com> ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Jiayuan Chen <jiayuan.chen(a)linux.dev> net: skb: fix cross-cache free of KFENCE-allocated skb head David Howells <dhowells(a)redhat.com> rxrpc: Fix missing error checks for rxkad encryption/decryption failure David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Douya Le <ldy3087146292(a)gmail.com> rxrpc: Only put the call ref if one was acquired Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix key reference count leak from call->key David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling David Carlier <devnexen(a)gmail.com> net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() David Carlier <devnexen(a)gmail.com> net: lan966x: fix page pool leak in error paths David Carlier <devnexen(a)gmail.com> net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: set the payload size before calling the async handler Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: improve locking around idpf_vc_xn_push_free() Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect Jacky Bai <ping.bai(a)nxp.com> pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: Update the list of the PCI supported devices Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Borislav Petkov (AMD) <bp(a)alien8.de> EDAC/mc: Fix error path ordering in edac_mc_alloc() Lukas Wunner <lukas(a)wunner.de> X.509: Fix out-of-bounds access when parsing extensions Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Matthew Brost <matthew.brost(a)intel.com> workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Handle percpu handler address for ORC unwinder Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Remove unnecessary checks for ORC unwinder Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_{data_ready,write_space} Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" Andrea Righi <arighi(a)nvidia.com> sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Geert Uytterhoeven <geert+renesas(a)glider.be> arm64: dts: renesas: white-hawk-cpu-common: Add pin control for DSI-eDP IRQ Jakub Kicinski <kuba(a)kernel.org> nfc: nci: complete pending data exchange on device close Chaitanya Kulkarni <kch(a)nvidia.com> blktrace: fix __this_cpu_read/write in preemptible context robbieko <robbieko(a)synology.com> btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Filipe Manana <fdmanana(a)suse.com> btrfs: remove pointless out labels from extent-tree.c Daniel Vacek <neelx(a)suse.com> btrfs: remove unused flag EXTENT_BUFFER_CORRUPT Daniel Vacek <neelx(a)suse.com> btrfs: remove unused flag EXTENT_BUFFER_READAHEAD David Sterba <dsterba(a)suse.com> btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait David Sterba <dsterba(a)suse.com> btrfs: remove unused define WAIT_PAGE_LOCK for extent io David Sterba <dsterba(a)suse.com> btrfs: make wait_on_extent_buffer_writeback() static inline Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: skip connector validation before init Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope ------------- Diffstat: Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + .../boot/dts/renesas/white-hawk-cpu-common.dtsi | 8 + arch/loongarch/include/asm/setup.h | 3 + arch/loongarch/kernel/unwind_orc.c | 28 +- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/gpu/drm/i915/display/intel_psr.c | 30 ++- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/input/misc/uinput.c | 35 ++- drivers/misc/fastrpc.c | 4 +- drivers/mmc/host/vub300.c | 2 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 28 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- .../intel/uncore-frequency/uncore-frequency-tpmi.c | 8 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- fs/btrfs/disk-io.c | 13 +- fs/btrfs/extent-tree.c | 30 +-- fs/btrfs/extent_io.c | 33 +-- fs/btrfs/extent_io.h | 18 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 2 +- kernel/sched/ext.c | 48 +++- kernel/trace/blktrace.c | 4 +- kernel/workqueue.c | 14 +- lib/crypto/chacha.c | 4 + mm/filemap.c | 11 +- net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/core/skbuff.c | 5 +- net/core/skmsg.c | 14 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/seg6_iptunnel.c | 34 ++- net/mptcp/pm_netlink.c | 24 +- net/mptcp/protocol.c | 13 +- net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/nfc/nci/core.c | 9 + net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/call_object.c | 25 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 2 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/sendmsg.c | 2 +- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/unix/af_unix.c | 8 +- net/xfrm/xfrm_user.c | 3 + sound/pci/hda/patch_hdmi.c | 1 + sound/soc/generic/simple-card-utils.c | 7 +- 75 files changed, 742 insertions(+), 361 deletions(-)

1 month

16
17
0 0

ペットを愛する、経営者様へ

by 日本ペットホテル協会

　　ペットを愛する、経営者様へ　　　地域で愛犬を安心して預けられる　ペットホテル・トリミング事業を始めませんか？　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン　　　“ONE LUKE（ワンルーク）” 　　　　※「開業パック」をご用意しているので　　　　経験や資格が無くても始められます。　　　■　開催方式　　　オンライン（申込後に参加方法をご案内）　　■　日程　　　4月21日（火）13:00〜14:00　残り1枠　　　4月23日（木）13:00〜14:00　残り1枠　　　4月27日（月）13:00〜14:00 　　　4月30日（木）11:00〜12:00 　■　定員　　　5名　　■　参加申込はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　　　お世話になります。　　この度は、ペットホテル・トリミングサロンの　フラチャイズ事業説明会の開催をご案内いたします。　　ペットホテルとトリミングサービスを提供する　　ONE LUKE（ワンルーク）　　は、ワンちゃんが好きすぎる創業者が実際に　ペットホテルに預けたときに感じた不安や　思ったことを施設づくりに活かしています。　　　例えばワンちゃんが泊まるときに、少しでも　広く、心地よく過ごして欲しいという思いから、　鉄のゲージではなくオーダーで職人さんに　「お部屋」をつくっていただいています。　　　そうした愛犬家目線のきめ細かいサービスが支持され、　ワンルークを利用した方は高い確率でリピートしてくれます。　　　日本ではいまや「8世帯に1世帯」がペットを飼うまでに　増えてきましたが、ペットホテルはまだまだ店舗数が　足りていないため、今後も成長が期待できます。　　　ここまでこの文章を読まれたということは、　あなたもワンちゃんが大好きなのではないでしょうか。　　ワンルークのFCオーナー様も愛犬家が多く、中には　ご自身が利用者だった、という方もいらっしゃいます。　　　説明会にて詳しいビジネスモデルをお伝えしますので、　新規事業を探している愛犬家の経営者様は　この機会にぜひご参加ください。　　　地域のペットライフを豊かにし、愛犬が安心して　過ごせる空間を一緒につくっていきましょう。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン　　　“ONE LUKE（ワンルーク）” 　　■　参加申込はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　 *********************************************************************** 本メールのご不要な方には大変ご迷惑をおかけいたしました。お手数お掛けしますが、メール不要のお手続きは下記URLよりお願いいたします。 <メール停止フォーム> 　https://oneluke-fc-seminar.jp/mail/ *********************************************************************** 日本ペットホテル協会株式会社愛知県名古屋市千種区内山3丁目9-23 3F TEL:052-784-8416 ***********************************************************************

1 month

1
0
0 0

[PATCH 5.15 000/570] 5.15.203-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.203 release. There are 570 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.203-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.203-rc1 Jens Axboe <axboe(a)kernel.dk> io_uring/poll: correctly handle io_poll_add() return value on update Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Sean Heelan <seanheelan(a)gmail.com> ksmbd: Fix dangling pointer in krb_authenticate Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: Fix refcount leak when invalid session is found on session lookup Maarten Lankhorst <dev(a)lankhorst.se> drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Johan Hovold <johan(a)kernel.org> i2c: cp2615: fix serial string NULL-deref at probe Justin Stitt <justinstitt(a)google.com> i2c: cp2615: replace deprecated strncpy with strscpy Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix potencial OOB in get_file_all_info() for compound requests Luo Haiyang <luo.haiyang(a)zte.com.cn> tracing: Fix potential deadlock in cpu hotplug with osnoise Nikunj A Dadhania <nikunj(a)amd.com> x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Protect the driver specific lists Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: save ailp before dropping the AIL lock in push callbacks Jiayuan Chen <jiayuan.chen(a)shopee.com> ext4: fix use-after-free in update_super_work when racing with umount Zqiang <qiang.zhang(a)linux.dev> ext4: fix the might_sleep() warnings in kvfree() Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" GuoHan Zhao <zhaoguohan(a)kylinos.cn> xen/privcmd: unregister xenstore notifier on module exit Florian Westphal <fw(a)strlen.de> netlink: add nla be16/32 types to minlen array David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy John Johansen <john.johansen(a)canonical.com> apparmor: fix race between freeing data and fs accessing it John Johansen <john.johansen(a)canonical.com> apparmor: fix race on rawdata dereference John Johansen <john.johansen(a)canonical.com> apparmor: fix differential encoding verification John Johansen <john.johansen(a)canonical.com> apparmor: fix unprivileged local user can do privileged policy management John Johansen <john.johansen(a)canonical.com> apparmor: Fix double free of ns_name in aa_replace_profiles() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix side-effect bug in match_char() macro usage John Johansen <john.johansen(a)canonical.com> apparmor: fix: limit the number of levels of policy namespaces Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: replace recursive profile removal with iterative approach Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix memory leak in verify_header Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: validate DFA start states are in bounds in unpack_pdb Nuno Sa <nuno.sa(a)analog.com> iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer Kent Gibson <warthog618(a)gmail.com> gpiolib: cdev: fix uninitialised kfifo Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Evaluate orphan _REG under EC device Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Jens Axboe <axboe(a)kernel.dk> io_uring/tctx: work around xa_store() allocation error issue Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Navaneeth K <knavaneeth786(a)gmail.com> staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser Shuhao Fu <sfual(a)cse.ust.hk> smb: client: Fix refcount leak for cifs_sb_tlink Matt Johnston <matt(a)codeconstruct.com.au> net: mctp: Don't access ifa_index when missing Quanmin Yan <yanquanmin1(a)huawei.com> fbcon: Set fb_display[i]->mode to NULL when the mode is released Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Move IRQ request in probe Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind Cengiz Can <cengiz.can(a)canonical.com> nvmet-tcp: fix use-before-check of sg in bounds validation Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Davidlohr Bueso <dave(a)stgolabs.net> futex: Clear stale exiting pointer in futex_lock_pi() retry path Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> dmaengine: xilinx_dma: Program interrupt delay timeout Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix freeing the allocated ida too late Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error when running device stats on multiple devices fs Mark Harmstone <mark(a)harmstone.com> btrfs: fix super block offset in error message in btrfs_validate_super() Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix dma_device directions Felix Gu <ustc.gu(a)gmail.com> phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Theodore Ts'o <tytso(a)mit.edu> ext4: always drain queued discard work in ext4_mb_release() Baokun Li <libaokun(a)linux.alibaba.com> ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Helen Koike <koike(a)igalia.com> ext4: reject mount if bigalloc with s_first_data_block != 0 Ye Bin <yebin10(a)huawei.com> ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Jan Kara <jack(a)suse.cz> ext4: make recently_deleted() properly work with lazy itable initialization Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: convert inline data to extents when truncate exceeds inline size Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: stop reclaim before pushing AIL during unmount Milos Nikic <nikic.milos(a)gmail.com> jbd2: gracefully abort on checkpointing state corruptions Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: ses: Handle positive SCSI error from ses_recv_diag() Tyllis Xu <livelycarpet87(a)gmail.com> scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Zhan Xusheng <zhanxusheng1024(a)gmail.com> alarmtimer: Fix argument order in alarm_timer_forward() Jiucheng Xu <jiucheng.xu(a)amlogic.com> erofs: add GFP_NOIO in the bio completion if needed xietangxin <xietangxin(a)yeah.net> virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Yuchan Nam <entropy1110(a)gmail.com> media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: conservative: Reset requested_freq on limits change Ali Norouzi <ali.norouzi(a)keysight.com> can: gw: fix OOB heap access in cgw_csum_crc8_rel() Vasily Gorbik <gor(a)linux.ibm.com> s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> s390/syscalls: Add spectre boundary for syscall dispatch table Marc Kleine-Budde <mkl(a)pengutronix.de> spi: spi-fsl-lpspi: fix teardown order issue (UAF) Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix clock leak on PLL lock failure Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix unchecked clk_prepare_enable() return value Marc Buerg <buermarc(a)googlemail.com> sysctl: fix uninitialized variable in proc_do_large_bitmap Sanman Pradhan <psanman(a)juniper.net> hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Weiming Shi <bestswngs(a)gmail.com> ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Install address space handler at the namespace root Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix ECDT probe ordering issues Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix EC address space handler unregistration Hans de Goede <hdegoede(a)redhat.com> ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Hans de Goede <hdegoede(a)redhat.com> ACPICA: include/acpi/acpixf.h: Fix indentation Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix the device initialization Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Yihang Li <liyihang9(a)huawei.com> scsi: scsi_transport_sas: Fix the maximum channel scanning issue Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Return EINVAL for invalid arp index error Anil Samal <anil.samal(a)intel.com> RDMA/irdma: Fix deadlock during netdev reset with active connections Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() Ivan Barrera <ivan.d.barrera(a)intel.com> RDMA/irdma: Clean up unnecessary dereference of event->cm_node Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Update ibqp state to error if QP is already in error state Chuck Lever <chuck.lever(a)oracle.com> RDMA/rw: Fall back to direct SGE on MR pool exhaustion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: Synchronize cache for the page selector Paolo Valerio <pvalerio(a)redhat.com> net: macb: use the current queue number for stats David Carlier <devnexen(a)gmail.com> netfilter: ctnetlink: use netlink policy range checks Florian Westphal <fw(a)strlen.de> netlink: allow be16 and be32 types in all uint policy checks Florian Westphal <fw(a)strlen.de> netlink: introduce bigendian integer types Jakub Kicinski <kuba(a)kernel.org> netlink: hide validation union fields from kdoc Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: reject out-of-range attributes via policy Florian Westphal <fw(a)strlen.de> netlink: introduce NLA_POLICY_MAX_BE Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: skip expectations in other netns via proc Ren Wei <n05ec(a)lzu.edu.cn> netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Weiming Shi <bestswngs(a)gmail.com> netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: clamp SCO altsetting table indices Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Miguel Ojeda <ojeda(a)kernel.org> dma-mapping: add missing `inline` for `dma_free_attrs` Wei Fang <wei.fang(a)nxp.com> net: enetc: fix the output issue of 'ethtool --show-ring' Yochai Eisenrich <echelonh(a)gmail.com> net: fix fanout UAF in packet_release() via NETDEV_UP race Alok Tiwari <alok.a.tiwari(a)oracle.com> platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Qi Tang <tpluszz77(a)gmail.com> net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: validate MPLS set/set_masked payload length Toke Høiland-Jørgensen <toke(a)redhat.com> net: openvswitch: Avoid releasing netdev before teardown completes Jakub Kicinski <kuba(a)kernel.org> nfc: nci: fix circular locking dependency in nci_close_device Mohammad Heib <mheib(a)redhat.com> ionic: fix persistent MAC address override on PF Luca Leonardo Scorcia <l.scorcia(a)gmail.com> pinctrl: mediatek: common: Fix probe failure for devices without EINT Helen Koike <koike(a)igalia.com> Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Anas Iqbal <mohd.abd.6602(a)gmail.com> Bluetooth: hci_ll: Fix firmware leak on error path Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Oliver Hartkopp <socketcan(a)hartkopp.net> can: statistics: add missing atomic access in hot path Eric Dumazet <edumazet(a)google.com> af_key: validate families in pfkey_send_migrate() Sabrina Dubroca <sd(a)queasysnail.net> esp: fix skb leak with espintcp and async crypto Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Fix the usage of skb->sk Sabrina Dubroca <sd(a)queasysnail.net> xfrm: call xdo_dev_state_delete during state update Uzair Mughal <contact(a)uzair.is-a.dev> ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Isaac J. Manjarres <isaacmanjarres(a)google.com> dma-buf: Include ioctl.h in UAPI header Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Ihor Solodrai <ihor.solodrai(a)linux.dev> module: Fix kernel panic when a symbol st_shndx is out of bounds Romain Sioen <romain.sioen(a)microchip.com> HID: mcp2221: cancel last I2C command on read error Valentin Spreckels <valentin(a)spreckels.dev> net: usb: r8152: add TRENDnet TUC-ET2G Günther Noack <gnoack(a)google.com> HID: magicmouse: avoid memory leak in magicmouse_report_fixup() Julius Lehmann <lehmanju(a)devpi.de> HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 Keith Busch <kbusch(a)kernel.org> nvme-pci: ensure we're polling a polled queue Hans de Goede <johannes.goede(a)oss.qualcomm.com> platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Leif Skunberg <diamondback(a)cohunt.app> platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Keith Busch <kbusch(a)kernel.org> nvme-pci: cap queue creation to used queues Peter Metz <peter.metz(a)unarin.com> platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list Günther Noack <gnoack(a)google.com> HID: asus: avoid memory leak in asus_report_fixup() Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Release module BTF IDR before module unload Danilo Krummrich <dakr(a)kernel.org> sh: platform_early: remove pdev->driver_override check Juergen Gross <jgross(a)suse.com> xen/privcmd: add boot control for restricted usage in domU Juergen Gross <jgross(a)suse.com> xen/privcmd: restrict usage in unprivileged domU Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: de-constify set commit ops function argument Josh Law <objecting(a)objecting.org> tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure Josh Law <objecting(a)objecting.org> lib/bootconfig: check xbc_init_node() return in override path Rahul Bukte <rahul.bukte(a)sony.com> drm/i915/gt: Check set_default_submission() before deferencing Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: fix use-after-free of share_conf in compound request Kamal Dasu <kamal.dasu(a)broadcom.com> mtd: rawnand: brcmnand: skip DMA during panic write Kamal Dasu <kamal.dasu(a)broadcom.com> mtd: rawnand: serialize lock/unlock against other NAND operations Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> i2c: fsi: Fix a potential leak in fsi_i2c_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() Weiming Shi <bestswngs(a)gmail.com> icmp: fix NULL pointer dereference in icmp_tag_validation() Anas Iqbal <mohd.abd.6602(a)gmail.com> net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Muhammad Hammad Ijaz <mhijaz(a)amazon.com> net: mvpp2: guard flow control update with global_tx_fc in buffer switching Weiming Shi <bestswngs(a)gmail.com> nfnetlink_osf: validate individual option lengths in fingerprints Xiang Mei <xmei5(a)asu.edu> net: bonding: fix NULL deref in bond_debug_rlb_hash_show Xiang Mei <xmei5(a)asu.edu> udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix uninitialized rx_fs_lock Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: processor: Fix previous acpi_processor_errata_piix4() fix Guenter Roeck <linux(a)roeck-us.net> wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix NULL deref in mesh_matches_local() Kohei Enju <kohei(a)enjuk.jp> igc: fix missing update of skb->tail in igc_xmit_frame() Nikola Z. Ivanov <zlatistiv(a)gmail.com> net: usb: aqc111: Do not perform PM inside suspend callback Jiayuan Chen <jiayuan.chen(a)shopee.com> net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Wen Gu <guwen(a)linux.alibaba.com> net/smc: Fix slab-out-of-bounds issue in fallback Wen Gu <guwen(a)linux.alibaba.com> net/smc: Only save the original clcsock callback functions Bart Van Assche <bvanassche(a)acm.org> PM: runtime: Fix a race condition related to device removal Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> sched: idle: Consolidate the handling of two special cases Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown Dexuan Cui <decui(a)microsoft.com> net: mana: Improve the HWC error handling Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: increase WoL poll timeout Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: xt_time: use unsigned int for monthday bit shift Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_CT: drop pending enqueued packets on template removal Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_ct: drop pending enqueued packets on removal Andrii Melnychenko <a.melnychenko(a)vyos.io> netfilter: nft_ct: add seqadj extension for natted connections Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Lukas Johannes Möller <research(a)johannes-moeller.dev> netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Florian Westphal <fw(a)strlen.de> netfilter: ctnetlink: remove refcounting in expectation dumpers Jiayuan Chen <jiayuan.chen(a)shopee.com> net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> Bluetooth: qca: fix ROM version reading on WCN3998 chips Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HIDP: Fix possible UAF Christian Eggers <ceggers(a)arri.de> Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Christian Eggers <ceggers(a)arri.de> Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Christian Eggers <ceggers(a)arri.de> Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU Felix Gu <ustc.gu(a)gmail.com> firmware: arm_scpi: Fix device_node reference leak in probe path Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Add cleanup.h based auto release via __free(device_node) markings Peddolla Harshavardhan Reddy <peddolla.reddy(a)oss.qualcomm.com> wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Kuniyuki Iwashima <kuniyu(a)google.com> wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. Richard Genoud <richard.genoud(a)bootlin.com> soc: fsl: qbman: fix race condition in qman_destroy_fq ZhengYuan Huang <gality369(a)gmail.com> btrfs: tree-checker: fix misleading root drop_level error message Yang Yang <n05ec(a)lzu.edu.cn> batman-adv: avoid OGM aggregation when skb tailroom is insufficient Maíra Canal <mcanal(a)igalia.com> pmdomain: bcm: bcm2835-power: Increase ASB control timeout Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: avoid sending RM_ADDR over same subflow Natalie Vock <natalie.vock(a)gmx.de> drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink Andrew Lunn <andrew(a)lunn.ch> net: phy: register phy led_triggers during probe to avoid AB-BA deadlock Thorsten Blum <thorsten.blum(a)linux.dev> smb: client: Don't log plaintext credentials in cifs_set_cifscreds Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() Daniil Dulov <d.dulov(a)aladdin.ru> wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: move scan done work to wiphy work Daniel Hodges <git(a)danielhodges.dev> wifi: libertas: fix use-after-free in lbs_free_adapter() Jan Kara <jack(a)suse.cz> ext4: always allocate blocks only from groups inode can use Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix null pointer dereference error in generate_encryptionkey Brian Foster <bfoster(a)redhat.com> ext4: fix dirtyclusters double decrement on fs shutdown Zhang Yi <yi.zhang(a)huawei.com> ext4: drop extent cache when splitting extent fails Zhang Yi <yi.zhang(a)huawei.com> ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O Fedor Pchelkin <pchelkin(a)ispras.ru> ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: fix to avoid directly dereferencing user pointer Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() Ankit Garg <nktgrg(a)google.com> gve: defer interrupt enabling until NAPI registration Frederic Weisbecker <frederic(a)kernel.org> net: Handle napi_schedule() calls from non-interrupt Huacai Chen <chenhuacai(a)kernel.org> net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather David Hildenbrand (Red Hat) <david(a)kernel.org> mm/rmap: fix two comments related to huge_pmd_unshare() David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix two comments related to huge_pmd_unshare() David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix hugetlb_pmd_shared() Jane Chu <jane.chu(a)oracle.com> mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Miaohe Lin <linmiaohe(a)huawei.com> mm/hugetlb: make detecting shared pte more reliable Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: apply state adjust rules to some additional HAINAN vairants Maciej Andrzejewski ICEYE <maciej.andrzejewski(a)m-works.net> serial: uartlite: fix PM runtime usage count underflow on probe Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Raul E Rangel <rrangel(a)chromium.org> serial: 8250: Fix TX deadlock when using DMA Martin Roukala (né Peres) <martin.roukala(a)mupuf.org> serial: 8250_pci: add support for the AX99100 Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry Finn Thain <fthain(a)linux-m68k.org> mtd: Avoid boot crash in RedBoot partition table parser Chen Ni <nichen(a)iscas.ac.cn> mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Olivier Sobrie <olivier(a)sobrie.be> mtd: rawnand: pl353: make sure optimal timings are applied Luke Wang <ziniu.wang_1(a)nxp.com> mmc: sdhci: fix timing selection for 1-bit bus width Matthew Schwartz <matthew.schwartz(a)linux.dev> mmc: sdhci-pci-gli: fix GL9750 DMA write corruption Lukas Johannes Möller <research(a)johannes-moeller.dev> Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Lukas Johannes Möller <research(a)johannes-moeller.dev> Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix use-after-free access to PTP clock Ian Ray <ian.ray(a)gehealthcare.com> NFC: nxp-nci: allow GPIOs to sleep Ira Weiny <ira.weiny(a)intel.com> nvdimm/bus: Fix potential use after free in asynchronous initialization Jeff Layton <jlayton(a)kernel.org> sunrpc: fix cache_request leak in cache_release Julien Stephan <jstephan(a)baylibre.com> driver: iio: add missing checks on iio_info's callback access Jens Axboe <axboe(a)kernel.dk> io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Eric Dumazet <edumazet(a)google.com> l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Forget ranges when refining tnum after JSET Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch to the same value Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: mpu3050-i2c: fix pm_runtime error handling Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: mpu3050-core: fix pm_runtime error handling Chris Spencer <spencercw(a)gmail.com> iio: chemical: bme680: Fix measurement wait duration calculation Lukas Schmid <lukas.schmid(a)netcube.li> iio: potentiometer: mcp4131: fix double application of wiper shift Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() Oleksij Rempel <linux(a)rempel-privat.de> iio: dac: ds4424: reject -128 RAW value Filipe Manana <fdmanana(a)suse.com> btrfs: abort transaction on failure to update root in the received subvol ioctl Josh Law <objecting(a)objecting.org> lib/bootconfig: check bounds before writing in __xbc_open_brace() Josh Law <objecting(a)objecting.org> lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() Shashank Balaji <shashank.mahadasyam(a)sony.com> x86/apic: Disable x2apic on resume if the kernel expects so Junxiao Bi <junxiao.bi(a)oracle.com> scsi: core: Fix error handling for scsi_alloc_sdev() Josh Law <objecting(a)objecting.org> lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error Darrick J. Wong <djwong(a)kernel.org> xfs: fix undersized l_iclog_roundoff values Calvin Owens <calvin(a)wbinvd.org> tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Alysa Liu <Alysa.Liu(a)amd.com> drm/amdgpu: Fix use-after-free race in VM acquire Fan Wu <fanwu01(a)zju.edu.cn> net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Jian Zhang <zhangjian.3032(a)bytedance.com> net: ncsi: fix skb leak in error paths Helge Deller <deller(a)gmx.de> parisc: Fix initial page table creation for boot Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read Dave Airlie <airlied(a)redhat.com> nouveau/dpcd: return EBUSY for aux xfer if the device is asleep Helge Deller <deller(a)gmx.de> parisc: Increase initial mapping to 64 MB with KALLSYMS Sven Eckelmann <sven(a)narfation.org> batman-adv: Avoid double-rtnl_lock ELP metric worker Jakub Staniszewski <jakub.staniszewski(a)linux.intel.com> ice: fix retry for AQ command 0x06EE Long Li <longli(a)microsoft.com> net: mana: Ring doorbell at 4 CQ wraparounds Ariel Silver <arielsilver77(a)gmail.com> media: dvb-net: fix OOB access in ULE extension header tables Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Luka Gejak <luka.gejak(a)linux.dev> staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie Marc Zyngier <maz(a)kernel.org> irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> device property: Allow secondary lookup in fwnode_get_next_child_node() Steven Rostedt <rostedt(a)goodmis.org> time/jiffies: Mark jiffies_64_to_clock_t() notrace Randy Dunlap <rdunlap(a)infradead.org> time: add kernel-doc in time.c Max Kellermann <max.kellermann(a)ionos.com> ceph: fix i_nlink underrun during async unlink Ilya Dryomov <idryomov(a)gmail.com> libceph: admit message frames only in CEPH_CON_S_OPEN state Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Use u32 for non-negative values in ceph_monmap_decode() Ilya Dryomov <idryomov(a)gmail.com> libceph: prevent potential out-of-bounds reads in process_message_header() Ilya Dryomov <idryomov(a)gmail.com> libceph: reject preamble if control segment is empty Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() Mehul Rao <mehulrao(a)gmail.com> tipc: fix divide-by-zero in tipc_sk_filter_connect() Penghe Geng <pgeng(a)nvidia.com> mmc: core: Avoid bitfield RMW for claim/retune flags Felix Gu <ustc.gu(a)gmail.com> mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() Kalesh Singh <kaleshsingh(a)google.com> mm/tracing: rss_stat: ensure curr is false from kthread context Ziyi Guo <n7l8m4(a)u.northwestern.edu> usb: image: mdc800: kill download URB on timeout Oliver Neukum <oneukum(a)suse.com> usb: mdc800: handle signal and read racing Fan Wu <fanwu01(a)zju.edu.cn> usb: renesas_usbhs: fix use-after-free in ISR during device removal Oliver Neukum <oneukum(a)suse.com> usb: class: cdc-wdm: fix reordering issue in read code path Alan Stern <stern(a)rowland.harvard.edu> USB: core: Limit the length of unkillable synchronous timeouts Alan Stern <stern(a)rowland.harvard.edu> USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts Alan Stern <stern(a)rowland.harvard.edu> USB: usbcore: Introduce usb_bulk_msg_killable() Marc Zyngier <maz(a)kernel.org> usb: cdc-acm: Restore CAP_BRK functionnality to CH343 Gabor Juhos <j4g8y7(a)gmail.com> usb: core: don't power off roothub PHYs if phy_set_mode() fails Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: misc: uss720: properly clean up reference in uss720_probe() Oliver Neukum <oneukum(a)suse.com> usb: yurex: fix race in probe Zilin Guan <zilin(a)seu.edu.cn> usb: xhci: Fix memory leak in xhci_disable_slot() Christoffer Sandberg <cs(a)tuxedo.de> usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: skip LTM configuration for LAN7850 Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: fix silent drop of packets with checksum errors Qingye Zhao <zhaoqingye(a)honor.com> cgroup: fix race between task migration and iteration Sasha Levin <sashal(a)kernel.org> Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" Alok Tiwari <alok.a.tiwari(a)oracle.com> octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status Przemek Kitszel <przemyslaw.kitszel(a)intel.com> octeontx2-af: devlink health: use retained error fmsg API Alok Tiwari <alok.a.tiwari(a)oracle.com> octeontx2-af: devlink: fix NIX RAS reporter recovery condition Casey Connolly <casey.connolly(a)linaro.org> ASoC: detect empty DMI strings Chen Ni <nichen(a)iscas.ac.cn> ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition Ben Dooks <ben.dooks(a)codethink.co.uk> ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() Matt Vollrath <tactii(a)gmail.com> e1000/e1000e: Fix leak in DMA error cleanup Alok Tiwari <alok.a.tiwari(a)oracle.com> i40e: fix src IP mask checks and memcpy argument names in cloud filter Sungwoo Kim <iam(a)sung-woo.kim> nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> sched: idle: Make skipping governor callbacks more consistent Peng Fan <peng.fan(a)nxp.com> regulator: pca9450: Correct interrupt type Frieder Schrempf <frieder.schrempf(a)kontron.de> regulator: pca9450: Make IRQ optional Yuan Tan <tanyuan98(a)outlook.com> netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path David Dull <monderasdor(a)gmail.com> netfilter: x_tables: guard option walkers against 1-byte tail reads Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Wenyuan Li <2063309626(a)qq.com> can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> serial: caif: hold tty->link reference in ldisc_open and ser_release matteo.cotifava <cotifavamatteo(a)gmail.com> ASoC: soc-core: flush delayed work before removing DAIs and widgets Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> ASoC: core: Do not call link_exit() on uninitialized rtd objects Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: core: Exit all links before removing their components Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() matteo.cotifava <cotifavamatteo(a)gmail.com> ASoC: soc-core: drop delayed_work_pending() check before flush Weiming Shi <bestswngs(a)gmail.com> net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit Gal Pressman <gal(a)nvidia.com> net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery Hangbin Liu <liuhangbin(a)gmail.com> bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states Eric Badger <ebadger(a)purestorage.com> xprtrdma: Decrement re_receiving on the early exit paths J. Neuschäfer <j.ne(a)posteo.net> powerpc: 83xx: km83xx: Fix keymile vendor prefix Tzung-Bi Shih <tzungbi(a)kernel.org> remoteproc: mediatek: Unprepare SCP clock during system suspend Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> remoteproc: sysmon: Correct subsys_name_len type in QMI request Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> powerpc/uaccess: Fix inline assembly for clang build on PPC32 Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Check max frame size for implicit feedback mode, too Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix devices attaching to different hosts Sofia Schneider <sofia(a)schn.dev> ACPI: OSI: Add DMI quirk for Acer Aspire One D255 Al Viro <viro(a)zeniv.linux.org.uk> unshare: fix unshare_fs() handling Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpi3mr: Add NULL checks when resetting request and reply queues Piotr Mazek <pmazek(a)outlook.com> ACPI: PM: Save NVS memory on Lenovo G70-35 Jan Kiszka <jan.kiszka(a)siemens.com> scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Victor Nogueira <victor(a)mojatatu.com> net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks Jiayuan Chen <jiayuan.chen(a)shopee.com> net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Fernando Fernandez Mancera <fmancera(a)suse.de> net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled Fernando Fernandez Mancera <fmancera(a)suse.de> net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Fix error handling in VLAN add and delete paths Jakub Kicinski <kuba(a)kernel.org> nfc: rawsock: cancel tx_work before socket teardown Jakub Kicinski <kuba(a)kernel.org> nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Jakub Kicinski <kuba(a)kernel.org> nfc: nci: free skb on nci_transceive early error paths Ian Ray <ian.ray(a)gehealthcare.com> net: nfc: nci: Fix zero-length proprietary notifications Koichiro Den <den(a)valinux.co.jp> net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs Raju Rangoju <Raju.Rangoju(a)amd.com> amd-xgbe: fix sleep while atomic on suspend/resume Jakub Kicinski <kuba(a)kernel.org> ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() David Thomson <dt(a)linux-mail.net> xen/acpi-processor: fix _CST detection using undersized evaluation buffer Eric Dumazet <edumazet(a)google.com> indirect_call_wrapper: do not reevaluate function pointer Bart Van Assche <bvanassche(a)acm.org> wifi: wlcore: Fix a locking bug Bart Van Assche <bvanassche(a)acm.org> wifi: cw1200: Fix locking in error paths Alban Bedel <alban.bedel(a)lht.dlh.de> can: mcp251x: fix deadlock in error path of mcp251x_open Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix locking for bcm_op runtime updates Jiayuan Chen <jiayuan.chen(a)shopee.com> atm: lec: fix null-ptr-deref in lec_arp_clear_vccs Guenter Roeck <linux(a)roeck-us.net> dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler Ioana Ciornei <ioana.ciornei(a)nxp.com> dpaa2-switch: do not clear any interrupts automatically Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2-switch: serialize changes to priv->mac with a mutex Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy() Chintan Vankar <c-vankar(a)ti.com> net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table Jonathan Teh <jonathan.teh(a)outlook.com> platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Paolo Abeni <pabeni(a)redhat.com> selftests: mptcp: more stable simult_flows tests Junxiao Bi <junxiao.bi(a)oracle.com> scsi: core: Fix refcount leak for tagset_refcnt Lars Ellenberg <lars.ellenberg(a)linbit.com> drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Phillip Lougher <phillip(a)squashfs.org.uk> Squashfs: check metadata block offset is within range Davide Caratti <dcaratti(a)redhat.com> net/sched: ets: fix divide by zero in the offload path Jason Gunthorpe <jgg(a)ziepe.ca> IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Vahagn Vardanian <vahagn(a)redrays.io> wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() Johannes Berg <johannes.berg(a)intel.com> wifi: radiotap: reject radiotap with unknown bits Jun Seo <jun.seo.93(a)proton.me> ALSA: usb-audio: Use correct version for UAC3 header validation Kurt Borja <kuurtb(a)gmail.com> platform/x86: dell-wmi: Add audio/mic mute key codes Thorsten Blum <thorsten.blum(a)linux.dev> platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: defer freeing of boot services memory Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> can: usb: etas_es58x: correctly anchor the urb in the read bulk callback Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> can: ucan: Fix infinite loop from zero-length messages Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: pegasus: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: kalmia: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: kaweth: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nfc: pn533: properly drop the usb interface reference on disconnect Jens Axboe <axboe(a)kernel.dk> media: dvb-core: fix wrong reinitialization of ringbuffer on reopen Jann Horn <jannh(a)google.com> eventpoll: Fix integer overflow in ep_loop_check_proc() Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: arcnet: com20020-pci: fix support for 2.5Mbit cards Takashi Iwai <tiwai(a)suse.de> ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Andrey Vatoropin <a.vatoropin(a)crpt.ru> fbcon: check return value of con2fb_acquire_newinfo() Daniel Vetter <daniel.vetter(a)ffwll.ch> fbcon: move more common code into fb_open() Daniel Vetter <daniel.vetter(a)ffwll.ch> fbcon: Extract fbcon_open/release helpers Daniel Vetter <daniel.vetter(a)ffwll.ch> fbcon: Use delayed work for cursor Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths Gui-Dong Han <hanguidong02(a)gmail.com> hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Takashi Iwai <tiwai(a)suse.de> ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 Thomas Richard (TI) <thomas.richard(a)bootlin.com> usb: cdns3: fix role switching during resume Théo Lebrun <theo.lebrun(a)bootlin.com> usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() Hongyu Xie <xiehongyu1(a)kylinos.cn> usb: cdns3: remove redundant if branch Johan Hovold <johan(a)kernel.org> clk: tegra: tegra124-emc: fix device leak on set_rate() Johan Hovold <johan(a)kernel.org> mfd: omap-usb-host: Fix OF populate on driver rebind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mfd: omap-usb-host: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> mfd: qcom-pm8xxx: Fix OF populate on driver rebind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mfd: qcom-pm8xxx: Convert to platform remove callback returning void Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> mfd: qcom-pm8xxx: switch away from using chained IRQ handlers Johan Hovold <johan(a)kernel.org> bus: omap-ocp2scp: fix OF populate on driver rebind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> bus: omap-ocp2scp: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> drm/tegra: dsi: fix device leak on probe Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: refactor ata_scsi_translate() Hannes Reinecke <hare(a)suse.de> ata: libata: remove pointless VPRINTK() calls Hannes Reinecke <hare(a)suse.de> ata: libata-scsi: drop DPRINTK calls for cdb translation Bart Van Assche <bvanassche(a)acm.org> scsi: ata: Call scsi_done() directly Wentao Liang <vulab(a)iscas.ac.cn> ARM: omap2: Fix reference count leaks in omap_control_init() Wang Qing <wangqing(a)vivo.com> ARM: OMAP2+: add missing of_node_put before break and return Johan Hovold <johan(a)kernel.org> memory: mtk-smi: fix device leak on larb probe Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> memory: mtk-smi: Convert to platform remove callback returning void Kohei Enju <kohei(a)enjuk.jp> bpf: Fix stack-out-of-bounds write in devmap Mark Harmstone <mark(a)harmstone.com> btrfs: fix incorrect key offset in error message in check_dev_extent_item() Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Use inclusive terms Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Cap the packet size pre-calculations Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Always initialize the UIC done completion Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices Jussi Laako <jussi(a)sonarnerd.net> ALSA: usb-audio: Update for native DSD support quirks Mathias Krause <minipli(a)grsecurity.net> scsi: lpfc: Properly set WC for DPP mapping Ben Hutchings <ben(a)decadent.org.uk> ip6_tunnel: Fix usage of skb_vlan_inet_prepare() Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> ARM: clean up the memset64() C wrapper ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- Documentation/hwmon/adm1177.rst | 8 +- .../ethernet/freescale/dpaa2/mac-phy-support.rst | 9 +- Makefile | 4 +- arch/arm/include/asm/string.h | 14 +- arch/arm/mach-omap2/cm_common.c | 8 +- arch/arm/mach-omap2/control.c | 29 +- arch/arm/mach-omap2/prm_common.c | 8 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 1 - arch/mips/lib/multi3.c | 6 +- arch/parisc/include/asm/pgtable.h | 2 +- arch/parisc/kernel/head.S | 7 +- arch/powerpc/include/asm/uaccess.h | 2 +- arch/powerpc/platforms/83xx/km83xx.c | 4 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/syscall.c | 2 + arch/sh/drivers/platform_early.c | 4 - arch/x86/include/asm/efi.h | 2 +- arch/x86/kernel/apic/apic.c | 6 + arch/x86/kernel/cpu/common.c | 18 +- arch/x86/kvm/mmu/mmu.c | 13 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 ++- crypto/af_alg.c | 4 +- drivers/acpi/acpi_processor.c | 15 +- drivers/acpi/acpica/acevents.h | 4 + drivers/acpi/acpica/evregion.c | 6 +- drivers/acpi/acpica/evxfregn.c | 146 ++++++- drivers/acpi/ec.c | 52 ++- drivers/acpi/osi.c | 13 + drivers/acpi/osl.c | 2 +- drivers/acpi/sleep.c | 8 + drivers/ata/libata-core.c | 3 - drivers/ata/libata-sata.c | 4 +- drivers/ata/libata-scsi.c | 153 +++---- drivers/ata/libata-sff.c | 4 - drivers/ata/libata.h | 1 - drivers/base/power/runtime.c | 1 + drivers/base/property.c | 27 +- drivers/base/regmap/regmap.c | 30 +- drivers/block/drbd/drbd_actlog.c | 53 +-- drivers/block/drbd/drbd_interval.h | 5 +- drivers/bluetooth/btqca.c | 2 + drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/bus/omap-ocp2scp.c | 19 +- drivers/clk/tegra/clk-tegra124-emc.c | 2 +- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 3 + drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpuidle/cpuidle.c | 10 - drivers/dma/idxd/cdev.c | 10 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 33 +- drivers/dma/xilinx/xilinx_dma.c | 66 +-- drivers/firmware/arm_scpi.c | 5 +- drivers/firmware/efi/mokvar-table.c | 2 +- drivers/gpio/gpiolib-cdev.c | 13 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +- drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 72 +++- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 6 +- drivers/hid/hid-asus.c | 15 +- drivers/hid/hid-cmedia.c | 2 +- drivers/hid/hid-creative-sb0540.c | 2 +- drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/hid-multitouch.c | 7 + drivers/hid/hid-zydacron.c | 2 +- drivers/hid/wacom_wac.c | 10 + drivers/hwmon/adm1177.c | 54 ++- drivers/hwmon/max16065.c | 26 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/isl68137.c | 7 +- drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/q54sj108a2.c | 19 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/i2c-cp2615.c | 5 +- drivers/i2c/busses/i2c-fsi.c | 1 + drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 + drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +- drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +- drivers/i3c/master/mipi-i3c-hci/core.c | 6 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/chemical/bme680_core.c | 2 +- drivers/iio/chemical/sps30_i2c.c | 2 +- drivers/iio/chemical/sps30_serial.c | 2 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/dac/ds4424.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 50 ++- drivers/iio/gyro/mpu3050-i2c.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/industrialio-core.c | 7 +- drivers/iio/industrialio-event.c | 9 + drivers/iio/inkern.c | 35 +- drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/potentiometer/mcp4131.c | 2 +- drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/infiniband/hw/mthca/mthca_provider.c | 5 +- drivers/input/joystick/xpad.c | 2 + drivers/input/misc/uinput.c | 35 +- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/iommu/intel/dmar.c | 3 +- drivers/irqchip/irq-gic-v3-its.c | 4 + drivers/media/dvb-core/dmxdev.c | 4 +- drivers/media/dvb-core/dvb_net.c | 3 + drivers/media/mc/mc-request.c | 5 + drivers/media/usb/uvc/uvc_driver.c | 88 ++-- drivers/media/usb/uvc/uvcvideo.h | 2 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/memory/mtk-smi.c | 11 +- drivers/mfd/omap-usb-host.c | 11 +- drivers/mfd/qcom-pm8xxx.c | 53 +-- drivers/mmc/host/mmci_qcom_dml.c | 1 + drivers/mmc/host/sdhci-pci-gli.c | 9 + drivers/mmc/host/sdhci.c | 9 +- drivers/mmc/host/vub300.c | 2 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 14 +- drivers/mtd/nand/raw/pl35x-nand-controller.c | 3 + drivers/mtd/parsers/redboot.c | 6 +- drivers/net/arcnet/com20020-pci.c | 16 +- drivers/net/bonding/bond_debugfs.c | 16 +- drivers/net/bonding/bond_main.c | 8 +- drivers/net/caif/caif_serial.c | 3 + drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/spi/mcp251x.c | 15 +- drivers/net/can/usb/ems_usb.c | 7 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 7 +- drivers/net/can/usb/gs_usb.c | 11 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/dsa/bcm_sf2.c | 8 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 - drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe.h | 3 - drivers/net/ethernet/arc/emac_main.c | 11 + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +- drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 18 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/cadence/macb_ptp.c | 4 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 7 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.h | 10 +- .../freescale/dpaa2/dpaa2-switch-ethtool.c | 34 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 57 ++- .../net/ethernet/freescale/dpaa2/dpaa2-switch.h | 9 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_main.c | 5 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 - drivers/net/ethernet/intel/e1000e/netdev.c | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +- drivers/net/ethernet/intel/ice/ice_common.c | 1 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 35 +- drivers/net/ethernet/intel/igc/igc_main.c | 7 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 468 ++++++--------------- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/microsoft/mana/gdma_main.c | 4 - drivers/net/ethernet/microsoft/mana/hw_channel.c | 77 ++-- drivers/net/ethernet/microsoft/mana/mana_en.c | 23 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 18 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/ethernet/ti/cpsw_ale.c | 9 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/phy/phy_device.c | 13 +- drivers/net/usb/aqc111.c | 12 +- drivers/net/usb/kalmia.c | 7 + drivers/net/usb/kaweth.c | 13 + drivers/net/usb/lan78xx.c | 8 +- drivers/net/usb/lan78xx.h | 3 + drivers/net/usb/pegasus.c | 13 +- drivers/net/usb/r8152.c | 1 + drivers/net/virtio_net.c | 1 + drivers/net/vxlan/vxlan_core.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 4 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/net/wireless/st/cw1200/pm.c | 2 + drivers/net/wireless/ti/wlcore/main.c | 4 +- drivers/net/wireless/ti/wlcore/tx.c | 2 +- drivers/net/wireless/virt_wifi.c | 1 - drivers/nfc/nxp-nci/i2c.c | 4 +- drivers/nfc/pn533/uart.c | 14 +- drivers/nfc/pn533/usb.c | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/pci.c | 13 +- drivers/nvme/target/tcp.c | 6 +- drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/phy/renesas/phy-rcar-gen3-usb2.c | 123 +++--- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/dell/dell-wmi-base.c | 6 + .../dell/dell-wmi-sysman/passwordattr-interface.c | 1 - drivers/platform/x86/intel/hid.c | 13 + drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/platform/x86/touchscreen_dmi.c | 18 + drivers/regulator/pca9450-regulator.c | 41 +- drivers/remoteproc/mtk_scp.c | 39 ++ drivers/remoteproc/qcom_sysmon.c | 2 +- drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 36 +- drivers/scsi/lpfc/lpfc_sli4.h | 3 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 32 +- drivers/scsi/scsi_scan.c | 7 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 7 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/scsi/ufs/ufshcd.c | 29 +- drivers/soc/bcm/bcm2835-power.c | 27 +- drivers/soc/fsl/qbman/qman.c | 24 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 29 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 +- drivers/target/loopback/tcm_loop.c | 52 ++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 15 + drivers/tty/serial/8250/8250_pci.c | 17 + drivers/tty/serial/8250/8250_port.c | 6 + drivers/tty/serial/uartlite.c | 1 + drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/cdns3/core.c | 11 +- drivers/usb/class/cdc-acm.c | 14 + drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/class/usbtmc.c | 9 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/message.c | 100 ++++- drivers/usb/core/phy.c | 8 +- drivers/usb/core/quirks.c | 7 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_hid.c | 11 +- drivers/usb/gadget/function/f_rndis.c | 3 + drivers/usb/gadget/function/f_subset.c | 7 + drivers/usb/gadget/function/f_uac1_legacy.c | 47 ++- drivers/usb/gadget/function/f_uvc.c | 46 +- drivers/usb/gadget/function/u_ether.c | 8 +- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 13 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci.c | 4 +- drivers/usb/image/mdc800.c | 6 +- drivers/usb/misc/uss720.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/renesas_usbhs/common.c | 9 + drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/video/fbdev/core/fbcon.c | 262 ++++++------ drivers/video/fbdev/core/fbcon.h | 4 +- drivers/video/fbdev/core/fbmem.c | 2 + drivers/xen/privcmd.c | 76 +++- drivers/xen/xen-acpi-processor.c | 7 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 3 +- fs/btrfs/tree-checker.c | 21 +- fs/btrfs/volumes.c | 5 +- fs/btrfs/zoned.c | 6 +- fs/ceph/dir.c | 15 +- fs/cifs/connect.c | 1 - fs/cifs/inode.c | 6 +- fs/cifs/smb2ops.c | 8 +- fs/erofs/zdata.c | 3 + fs/eventpoll.c | 5 +- fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 22 +- fs/ext4/fast_commit.c | 17 +- fs/ext4/ialloc.c | 6 + fs/ext4/inode.c | 27 +- fs/ext4/mballoc.c | 69 ++- fs/ext4/super.c | 22 +- fs/ext4/sysfs.c | 10 +- fs/jbd2/checkpoint.c | 15 +- fs/ksmbd/mgmt/user_session.c | 4 +- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 63 ++- fs/squashfs/cache.c | 3 + fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_log.c | 2 + fs/xfs/xfs_mount.c | 7 +- include/acpi/acpixf.h | 142 ++++--- include/asm-generic/tlb.h | 77 +++- include/linux/dma-mapping.h | 4 +- include/linux/fbcon.h | 2 + include/linux/hugetlb.h | 17 +- include/linux/indirect_call_wrapper.h | 18 +- include/linux/irqchip/arm-gic-v3.h | 1 + include/linux/mm_types.h | 1 + include/linux/mmc/host.h | 9 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/of.h | 2 + include/linux/security.h | 1 + include/linux/swapops.h | 20 +- include/linux/usb.h | 8 +- include/linux/usb/r8152.h | 1 + include/net/act_api.h | 1 + include/net/netfilter/nf_conntrack_timeout.h | 1 + include/net/netfilter/nf_tables.h | 7 +- include/net/netlink.h | 39 +- include/net/sch_generic.h | 10 + include/net/udp_tunnel.h | 2 +- include/sound/soc.h | 2 + include/trace/events/kmem.h | 8 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + io_uring/io-wq.c | 2 +- io_uring/io_uring.c | 39 +- kernel/bpf/btf.c | 24 +- kernel/bpf/devmap.c | 22 +- kernel/bpf/verifier.c | 14 +- kernel/cgroup/cgroup.c | 1 + kernel/fork.c | 2 +- kernel/futex/core.c | 3 +- kernel/module.c | 7 + kernel/sched/idle.c | 39 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/time/time.c | 171 +++++++- kernel/trace/trace.c | 6 +- kernel/trace/trace_osnoise.c | 8 +- lib/bootconfig.c | 9 +- lib/crypto/chacha.c | 4 + lib/nlattr.c | 22 + mm/hugetlb.c | 141 ++++--- mm/mmu_gather.c | 33 ++ mm/rmap.c | 38 +- net/atm/lec.c | 98 +++-- net/atm/lec.h | 2 +- net/batman-adv/bat_iv_ogm.c | 3 + net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/hard-interface.c | 8 +- net/batman-adv/hard-interface.h | 1 + net/batman-adv/translation-table.c | 9 +- net/bluetooth/hidp/core.c | 16 +- net/bluetooth/l2cap_core.c | 55 ++- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 3 + net/bluetooth/sco.c | 10 +- net/bluetooth/smp.c | 13 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/bridge/br_device.c | 2 +- net/bridge/br_input.c | 2 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/bcm.c | 1 + net/can/gw.c | 6 +- net/can/proc.c | 3 +- net/ceph/auth.c | 6 +- net/ceph/messenger_v2.c | 31 +- net/ceph/mon_client.c | 6 +- net/core/dev.c | 2 +- net/core/rtnetlink.c | 9 +- net/hsr/hsr_device.c | 32 +- net/ipv4/esp4.c | 11 +- net/ipv4/icmp.c | 4 +- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/esp6.c | 11 +- net/ipv6/icmp.c | 3 + net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 7 +- net/ipv6/ndisc.c | 3 + net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 11 +- net/ipv6/seg6_iptunnel.c | 41 +- net/ipv6/xfrm6_output.c | 4 +- net/key/af_key.c | 19 +- net/l2tp/l2tp_ppp.c | 25 +- net/mac80211/debugfs.c | 14 +- net/mac80211/mesh.c | 6 + net/mctp/device.c | 17 +- net/mptcp/pm.c | 2 +- net/mptcp/pm_netlink.c | 81 ++-- net/mptcp/protocol.c | 2 + net/mptcp/protocol.h | 3 + net/mptcp/subflow.c | 15 +- net/ncsi/ncsi-aen.c | 3 +- net/ncsi/ncsi-rsp.c | 16 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 89 ++-- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 20 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++--- net/netfilter/nf_tables_api.c | 12 +- net/netfilter/nfnetlink_cthelper.c | 8 +- net/netfilter/nfnetlink_log.c | 10 +- net/netfilter/nfnetlink_osf.c | 13 + net/netfilter/nfnetlink_queue.c | 4 +- net/netfilter/nft_ct.c | 11 +- net/netfilter/nft_payload.c | 6 +- net/netfilter/nft_set_pipapo.c | 59 ++- net/netfilter/nft_set_pipapo.h | 2 + net/netfilter/x_tables.c | 23 + net/netfilter/xt_CT.c | 4 + net/netfilter/xt_IDLETIMER.c | 6 + net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_dccp.c | 4 +- net/netfilter/xt_rateest.c | 5 + net/netfilter/xt_tcpudp.c | 6 +- net/netfilter/xt_time.c | 4 +- net/nfc/nci/core.c | 31 +- net/nfc/nci/data.c | 12 +- net/nfc/rawsock.c | 11 + net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 9 +- net/packet/af_packet.c | 1 + net/qrtr/af_qrtr.c | 31 +- net/rds/ib_rdma.c | 7 +- net/rfkill/core.c | 37 +- net/rose/af_rose.c | 5 + net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/key.c | 2 +- net/rxrpc/server_key.c | 3 + net/sched/act_ct.c | 6 + net/sched/cls_api.c | 8 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_ets.c | 12 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_teql.c | 1 + net/smc/af_smc.c | 152 +++++-- net/smc/smc.h | 34 ++ net/smc/smc_close.c | 7 +- net/smc/smc_rx.c | 9 +- net/sunrpc/cache.c | 26 +- net/sunrpc/xprtrdma/verbs.c | 7 +- net/tipc/group.c | 6 +- net/tipc/socket.c | 2 + net/tls/tls_sw.c | 10 + net/wireless/core.c | 4 +- net/wireless/core.h | 4 +- net/wireless/pmsr.c | 1 + net/wireless/radiotap.c | 4 +- net/wireless/scan.c | 14 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 1 + security/apparmor/apparmorfs.c | 228 ++++++---- security/apparmor/include/label.h | 16 +- security/apparmor/include/lib.h | 12 + security/apparmor/include/match.h | 1 + security/apparmor/include/policy.h | 13 +- security/apparmor/include/policy_ns.h | 2 + security/apparmor/include/policy_unpack.h | 83 ++-- security/apparmor/label.c | 12 +- security/apparmor/match.c | 58 ++- security/apparmor/policy.c | 82 +++- security/apparmor/policy_ns.c | 2 + security/apparmor/policy_unpack.c | 74 +++- security/security.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/pci/hda/patch_conexant.c | 11 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/acp3x-rt5682-max9836.c | 9 +- sound/soc/codecs/adau1372.c | 34 +- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/meson/meson-codec-glue.c | 3 - sound/soc/soc-core.c | 44 +- sound/usb/caiaq/device.c | 2 +- sound/usb/endpoint.c | 10 +- sound/usb/quirks.c | 38 +- sound/usb/validate.c | 2 +- tools/bootconfig/main.c | 7 +- tools/objtool/check.c | 5 +- tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +- 518 files changed, 5450 insertions(+), 2789 deletions(-)

1 month

11
10
0 0

社長のNG行動

by 神田／ナレッジリンク

　お世話になります。ナレッジリンクセミナー事務局です。　　　「社員のモチベーションを上げようと声をかける」　「部下の相談に乗り、一緒に悩んであげる」　「現場のトラブルに、自ら先頭に立って対応する」　　もし社長がこれらを率先しているようであれば、　残念ながら、その組織の成長はそこで止まります。　　社長のその“優しさ”が、社員の甘えを生み、責任感を奪い、　「指示待ち人間」を量産する装置になっているからです。　　　4,800社の経営者が衝撃を受けた、　良かれと思ってやってしまう「社長のNG行動」の正体。　　組織を劇的に変えるための、　オンラインセミナーを開催いたします。　　1つでも心当たりがあれば、一度ご視聴ください。　　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　 ---------------------------------------------- 　　テーマ：　それ、危険です『社長のNG行動』　　　　　〜その行動が、組織崩壊を招く〜　　日程　： 4月21日（火）13:00スタート　※残11席　　　　　 5月19日（火）13:00スタート　　　　　※どちらの日程も内容は同じ　会場　：Zoom開催　定員　：先着100名（費用は不要） ---------------------------------------------- 　※経営層の方限定です　　　なぜ、社員は「言われたこと」しかやらないのか。　なぜ、次世代のリーダー候補が育たないのか。　　それは、能力の問題ではなく、　　良かれと思って続けている「社長の配慮」こそが、　組織成長を止める、最大のボトルネックかもしれません。　　本セミナーでは、4,800社以上が導入した　独自の組織論「識学」に基づき、社長の「NG行動」と　真の経営者へ脱皮するためのマインドセットを伝授します。　　　【セミナー内容(一部抜粋)】　 ○ NG行動3選　 ○ なぜ優秀なNo.2や部長が育たないのか　 ○ マネジメントスタイルの変革について　 ○ 導入企業の事例　　「管理職が育ったら任せる」ではなく「任せるから育つ」　という思考の逆転を提言。　　現場から「冷たくなった」と思われることを恐れず、　機能的な階層構造（仕組み）を作ることで　結果として社員全員を守り、　利益を最大化させる道筋を明示します。　「優しさ」で人を動かすのではなく、　「正しさ」で組織を動かす。　音声やお顔が表に出ることはございませんので　お気軽にご視聴ください。　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　　 ----------------------- 　一般社団法人ナレッジリンク　東京都千代田区神田小川町1-8-3 　電話：03-5256-7638 　セミナーのご案内が不要な方は大変残念ではございますが、　下記URLより手続き下さいませ。　　メール配信のワンクリック解除はこちら　https://fc-knowledgelink-corp.jp/mail/ 　

1 month

1
0
0 0

[PATCH 6.18 00/83] 6.18.23-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.23 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.23-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.23-rc1 Jiayuan Chen <jiayuan.chen(a)linux.dev> net: skb: fix cross-cache free of KFENCE-allocated skb head Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() David Howells <dhowells(a)redhat.com> rxrpc: Fix leak of rxgk context in rxgk_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix integer overflow in rxgk_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix missing error checks for rxkad encryption/decryption failure David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Keenan Dong <keenanat2000(a)gmail.com> rxrpc: fix oversized RESPONSE authenticator length check Keenan Dong <keenanat2000(a)gmail.com> rxrpc: fix RESPONSE authenticator parser OOB read Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Douya Le <ldy3087146292(a)gmail.com> rxrpc: Only put the call ref if one was acquired Marc Dionne <marc.c.dionne(a)gmail.com> rxrpc: Fix to request an ack if window is limited Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix key reference count leak from call->key Alok Tiwari <alok.a.tiwari(a)oracle.com> rxrpc: Fix rack timer warning to report unexpected mode Alok Tiwari <alok.a.tiwari(a)oracle.com> rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial Oleh Konko <security(a)1seal.org> rxrpc: Fix RxGK token loading to check bounds David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling David Howells <dhowells(a)redhat.com> rxrpc: Fix key parsing memleak David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys David Carlier <devnexen(a)gmail.com> net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() David Carlier <devnexen(a)gmail.com> net: lan966x: fix page pool leak in error paths David Carlier <devnexen(a)gmail.com> net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: set the payload size before calling the async handler Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: improve locking around idpf_vc_xn_push_free() Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect SeongJae Park <sj(a)kernel.org> mm/damon/stat: deallocate damon_call() failure leaking damon_ctx SeongJae Park <sj(a)kernel.org> mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails Hao Li <hao.li(a)linux.dev> mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug Alex Dvoretsky <advoretsky(a)gmail.com> igb: remove napi_synchronize() in igb_down() Jacky Bai <ping.bai(a)nxp.com> pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: Update the list of the PCI supported devices Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Borislav Petkov (AMD) <bp(a)alien8.de> EDAC/mc: Fix error path ordering in edac_mc_alloc() Lukas Wunner <lukas(a)wunner.de> X.509: Fix out-of-bounds access when parsing extensions Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Marek Vasut <marek.vasut+renesas(a)mailbox.org> arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Heiko Stuebner <heiko(a)sntech.de> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Reset core count to 0 Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Qi Tang <tpluszz77(a)gmail.com> xfrm: hold dev ref until after transport_finish NF_HOOK Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Nathan Chancellor <nathan(a)kernel.org> modpost: Declare extra_warn with unused attribute Matthew Brost <matthew.brost(a)intel.com> workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Michal Wilczynski <m.wilczynski(a)samsung.com> firmware: thead: Fix buffer overflow and use standard endian macros Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy Anthony Pighin <anthony.pighin(a)nokia.com> i2c: imx: zero-initialize dma_slave_config for eDMA Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Give up GC if MSG_PEEK intervened. Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Simplify GC state. Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Count cyclic SCC. robbieko <robbieko(a)synology.com> btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Filipe Manana <fdmanana(a)suse.com> btrfs: remove pointless out labels from extent-tree.c Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" Takashi Iwai <tiwai(a)suse.de> Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: skip connector validation before init ------------- Diffstat: Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 11 + .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 18 -- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/firmware/thead,th1520-aon.c | 7 +- drivers/gpu/drm/i915/display/intel_psr.c | 30 ++- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/i2c/busses/i2c-imx.c | 2 +- drivers/input/misc/uinput.c | 35 ++- drivers/mmc/host/vub300.c | 19 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 20 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 5 +- drivers/net/ethernet/intel/igb/igb_main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 28 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 2 + .../intel/uncore-frequency/uncore-frequency-tpmi.c | 8 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- fs/btrfs/extent-tree.c | 24 +- include/linux/firmware/thead/thead,th1520-aon.h | 74 ------ include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 4 +- kernel/workqueue.c | 14 +- mm/damon/stat.c | 7 + mm/damon/sysfs.c | 3 +- mm/filemap.c | 11 +- mm/memory_hotplug.c | 20 ++ net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/core/skbuff.c | 5 +- net/ipv4/xfrm4_input.c | 5 +- net/ipv6/seg6_iptunnel.c | 34 ++- net/ipv6/xfrm6_input.c | 5 +- net/mptcp/pm_kernel.c | 24 +- net/mptcp/protocol.c | 2 + net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_object.c | 25 +- net/rxrpc/conn_event.c | 19 +- net/rxrpc/input_rack.c | 2 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 40 +-- net/rxrpc/output.c | 2 + net/rxrpc/proc.c | 37 +-- net/rxrpc/rxgk.c | 19 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/sendmsg.c | 2 +- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/unix/af_unix.c | 2 + net/unix/af_unix.h | 1 + net/unix/garbage.c | 125 +++++---- net/xfrm/xfrm_input.c | 18 +- net/xfrm/xfrm_user.c | 3 + scripts/mod/modpost.c | 2 +- sound/hda/codecs/realtek/alc662.c | 9 - 79 files changed, 838 insertions(+), 490 deletions(-)

1 month

14
13
0 0

[PATCH 6.19 00/86] 6.19.13-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.13 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.13-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.13-rc1 Jiayuan Chen <jiayuan.chen(a)linux.dev> net: skb: fix cross-cache free of KFENCE-allocated skb head Pengpeng Hou <pengpeng(a)iscas.ac.cn> rxrpc: proc: size address buffers for %pISpc output Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() David Howells <dhowells(a)redhat.com> rxrpc: Fix leak of rxgk context in rxgk_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix integer overflow in rxgk_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix missing error checks for rxkad encryption/decryption failure David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Keenan Dong <keenanat2000(a)gmail.com> rxrpc: fix oversized RESPONSE authenticator length check Keenan Dong <keenanat2000(a)gmail.com> rxrpc: fix RESPONSE authenticator parser OOB read Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Douya Le <ldy3087146292(a)gmail.com> rxrpc: Only put the call ref if one was acquired Marc Dionne <marc.c.dionne(a)gmail.com> rxrpc: Fix to request an ack if window is limited Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix key reference count leak from call->key Alok Tiwari <alok.a.tiwari(a)oracle.com> rxrpc: Fix rack timer warning to report unexpected mode Alok Tiwari <alok.a.tiwari(a)oracle.com> rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial Oleh Konko <security(a)1seal.org> rxrpc: Fix RxGK token loading to check bounds David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling David Howells <dhowells(a)redhat.com> rxrpc: Fix key parsing memleak David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys David Carlier <devnexen(a)gmail.com> net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() David Carlier <devnexen(a)gmail.com> net: lan966x: fix page pool leak in error paths David Carlier <devnexen(a)gmail.com> net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: set the payload size before calling the async handler Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: improve locking around idpf_vc_xn_push_free() Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect SeongJae Park <sj(a)kernel.org> mm/damon/stat: deallocate damon_call() failure leaking damon_ctx SeongJae Park <sj(a)kernel.org> mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails Hao Li <hao.li(a)linux.dev> mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug Sechang Lim <rhkrqnwk98(a)gmail.com> mm/vma: fix memory leak in __mmap_region() Alex Dvoretsky <advoretsky(a)gmail.com> igb: remove napi_synchronize() in igb_down() Jacky Bai <ping.bai(a)nxp.com> pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: Update the list of the PCI supported devices Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Borislav Petkov (AMD) <bp(a)alien8.de> EDAC/mc: Fix error path ordering in edac_mc_alloc() Lukas Wunner <lukas(a)wunner.de> X.509: Fix out-of-bounds access when parsing extensions Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Leo Timmins <leotimmins1974(a)gmail.com> liveupdate: propagate file deserialization failures Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Marek Vasut <marek.vasut+renesas(a)mailbox.org> arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Heiko Stuebner <heiko(a)sntech.de> Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86/intel-uncore-freq: Handle autonomous UFS status bit Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Reset core count to 0 Yazen Ghannam <yazen.ghannam(a)amd.com> x86/mce/amd: Filter bogus hardware errors on Zen3 clients Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ASoC: SOF: Intel: hda: modify period size constraints for ACE4 Janne Grunau <j(a)jannau.net> kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Qi Tang <tpluszz77(a)gmail.com> xfrm: hold dev ref until after transport_finish NF_HOOK Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Nathan Chancellor <nathan(a)kernel.org> modpost: Declare extra_warn with unused attribute Matthew Brost <matthew.brost(a)intel.com> workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works Michal Wilczynski <m.wilczynski(a)samsung.com> firmware: thead: Fix buffer overflow and use standard endian macros Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy Anthony Pighin <anthony.pighin(a)nokia.com> i2c: imx: zero-initialize dma_slave_config for eDMA robbieko <robbieko(a)synology.com> btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() Filipe Manana <fdmanana(a)suse.com> btrfs: remove pointless out labels from extent-tree.c Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL Takashi Iwai <tiwai(a)suse.de> Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: skip connector validation before init ------------- Diffstat: Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 11 + .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 18 -- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- arch/x86/kernel/cpu/mce/amd.c | 8 + crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/firmware/thead,th1520-aon.c | 7 +- drivers/gpu/drm/i915/display/intel_psr.c | 30 ++- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/i2c/busses/i2c-imx.c | 2 +- drivers/input/misc/uinput.c | 35 ++- drivers/mmc/host/vub300.c | 19 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 20 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 5 +- drivers/net/ethernet/intel/igb/igb_main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 28 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 2 + .../intel/uncore-frequency/uncore-frequency-tpmi.c | 8 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- fs/btrfs/extent-tree.c | 24 +- include/linux/firmware/thead/thead,th1520-aon.h | 74 ------ include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 4 +- kernel/liveupdate/luo_session.c | 9 +- kernel/workqueue.c | 14 +- mm/damon/stat.c | 7 + mm/damon/sysfs.c | 3 +- mm/filemap.c | 11 +- mm/memory_hotplug.c | 20 ++ mm/vma.c | 7 + net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/core/skbuff.c | 5 +- net/ipv4/xfrm4_input.c | 5 +- net/ipv6/seg6_iptunnel.c | 34 ++- net/ipv6/xfrm6_input.c | 5 +- net/mptcp/pm_kernel.c | 24 +- net/mptcp/protocol.c | 2 + net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_object.c | 25 +- net/rxrpc/conn_event.c | 19 +- net/rxrpc/input_rack.c | 2 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 40 +-- net/rxrpc/output.c | 2 + net/rxrpc/proc.c | 37 +-- net/rxrpc/rxgk.c | 19 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/sendmsg.c | 2 +- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/xfrm/xfrm_input.c | 18 +- net/xfrm/xfrm_user.c | 3 + scripts/Makefile.package | 3 +- scripts/mod/modpost.c | 2 +- sound/hda/codecs/realtek/alc662.c | 9 - sound/hda/controllers/intel.c | 7 +- sound/soc/sof/intel/hda-pcm.c | 14 +- 82 files changed, 795 insertions(+), 453 deletions(-)

1 month

14
13
0 0

[PATCH 6.6 00/50] 6.6.135-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.135 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.135-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.135-rc1 Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" David Howells <dhowells(a)redhat.com> rxrpc: Fix missing error checks for rxkad encryption/decryption failure David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Luxiao Xu <rakukuip(a)gmail.com> rxrpc: fix reference count leak in rxrpc_server_keyring() Yuqi Xu <xuyuqiabc(a)gmail.com> rxrpc: reject undecryptable rxkad response tickets Douya Le <ldy3087146292(a)gmail.com> rxrpc: Only put the call ref if one was acquired Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix key reference count leak from call->key David Howells <dhowells(a)redhat.com> rxrpc: Fix call removal to use RCU safe deletion David Carlier <devnexen(a)gmail.com> net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() Baolin Wang <baolin.wang(a)linux.alibaba.com> mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect Jacky Bai <ping.bai(a)nxp.com> pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: Update the list of the PCI supported devices Sebastian Brzezinka <sebastian.brzezinka(a)intel.com> drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat Haoze Xie <royenheart(a)gmail.com> batman-adv: hold claim backbone gateways by reference David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption Borislav Petkov (AMD) <bp(a)alien8.de> EDAC/mc: Fix error path ordering in edac_mc_alloc() Lukas Wunner <lukas(a)wunner.de> X.509: Fix out-of-bounds access when parsing extensions Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> xfrm: clear trailing padding in build_polexpire() Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Revert "mptcp: add needs_id for netlink appending addr" Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Srujana Challa <schalla(a)marvell.com> virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN André Draszik <andre.draszik(a)linaro.org> scsi: ufs: core: Fix use-after free in init error and remove paths Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: mm: Suppress TLB uniquification on EHINV hardware Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Always record SEGBITS in cpu_data.vmbits Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Jiayuan Chen <jiayuan.chen(a)linux.dev> mptcp: fix slab-use-after-free in __inet_lookup_established Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope ------------- Diffstat: Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/input/misc/uinput.c | 35 ++- drivers/mmc/host/vub300.c | 2 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 2 + drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- drivers/net/virtio_net.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/ufs/core/ufshcd.c | 31 ++- drivers/ufs/host/ufshcd-pci.c | 2 - drivers/ufs/host/ufshcd-pltfrm.c | 25 +- drivers/usb/gadget/function/f_hid.c | 11 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 2 +- include/ufs/ufshcd.h | 1 - lib/crypto/chacha.c | 4 + mm/filemap.c | 11 +- net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/ipv6/seg6_iptunnel.c | 41 ++- net/mptcp/pm_netlink.c | 24 +- net/mptcp/protocol.c | 13 +- net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_set_pipapo.c | 20 +- net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/call_object.c | 25 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 2 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/xfrm/xfrm_user.c | 3 + sound/soc/generic/simple-card-utils.c | 7 +- 60 files changed, 599 insertions(+), 308 deletions(-)

1 month

13
12
0 0

[PATCH 5.10 000/491] 5.10.253-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.253 release. There are 491 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.253-rc1 Jens Axboe <axboe(a)kernel.dk> io_uring/poll: correctly handle io_poll_add() return value on update Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Yang Yingliang <yangyingliang(a)huawei.com> device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> s390/syscalls: Add spectre boundary for syscall dispatch table Yang Yang <n05ec(a)lzu.edu.cn> batman-adv: avoid OGM aggregation when skb tailroom is insufficient Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> device property: Allow secondary lookup in fwnode_get_next_child_node() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> device property: Allow error pointer to be passed to fwnode APIs Daniel Scally <djrscally(a)gmail.com> device property: Check fwnode->secondary when finding properties Daniel Scally <djrscally(a)gmail.com> device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> device property: Unify access to of_node Andy Shevchenko <andy.shevchenko(a)gmail.com> device property: Retrieve fwnode from of_node via accessor Daniel Scally <djrscally(a)gmail.com> media: device property: Return true in fwnode_device_is_available for NULL ops Saravana Kannan <saravanak(a)google.com> device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev() Jaskaran Singh <jsingh(a)cloudlinux.com> nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Jaskaran Singh <jsingh(a)cloudlinux.com> Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Penghe Geng <pgeng(a)nvidia.com> mmc: core: Avoid bitfield RMW for claim/retune flags Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Drop reference counting of the bus_ops Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Drop redundant member in struct mmc host Maarten Lankhorst <dev(a)lankhorst.se> drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Baokun Li <libaokun(a)linux.alibaba.com> ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: stop reclaim before pushing AIL during unmount Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: save ailp before dropping the AIL lock in push callbacks Zqiang <qiang.zhang(a)linux.dev> ext4: fix the might_sleep() warnings in kvfree() Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: rfkill: prevent unlimited numbers of rfkill events from being created Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: separate dst_cache for input and output paths in seg6 lwtunnel Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang <liaochang1(a)huawei.com> cpufreq: governor: Free dbs_data directly when gov->init() fails Florian Westphal <fw(a)strlen.de> netlink: add nla be16/32 types to minlen array Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix Master Volume Control Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: don't use discriminatory terms on snd_soc_runtime_get_dai_fmt() GuoHan Zhao <zhaoguohan(a)kylinos.cn> xen/privcmd: unregister xenstore notifier on module exit David Howells <dhowells(a)redhat.com> rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Tyllis Xu <livelycarpet87(a)gmail.com> net: stmmac: fix integer underflow in chain mode Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Johan Hovold <johan(a)kernel.org> mmc: vub300: fix NULL-deref on disconnect David Carlier <devnexen(a)gmail.com> net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Ruide Cao <caoruide123(a)gmail.com> batman-adv: reject oversized global TT response buffers Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: pn533: allocate rx skb before consuming bytes Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Shawn Guo <shawnguo(a)kernel.org> arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Thomas Fourier <fourier.thomas(a)gmail.com> wifi: brcmsmac: Fix dma_free_coherent() size Oleh Konko <security(a)1seal.org> tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Tuan Do <tuan(a)calif.io> netfilter: nft_ct: fix use-after-free in timeout object destroy John Johansen <john.johansen(a)canonical.com> apparmor: fix race between freeing data and fs accessing it John Johansen <john.johansen(a)canonical.com> apparmor: fix race on rawdata dereference John Johansen <john.johansen(a)canonical.com> apparmor: fix differential encoding verification John Johansen <john.johansen(a)canonical.com> apparmor: fix unprivileged local user can do privileged policy management John Johansen <john.johansen(a)canonical.com> apparmor: Fix double free of ns_name in aa_replace_profiles() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix side-effect bug in match_char() macro usage John Johansen <john.johansen(a)canonical.com> apparmor: fix: limit the number of levels of policy namespaces Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: replace recursive profile removal with iterative approach Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: fix memory leak in verify_header Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> apparmor: validate DFA start states are in bounds in unpack_pdb Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Implement UVC_EXT_GPIO_UNIT Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Allow extra entities Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Move guid to entity David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather David Hildenbrand (Red Hat) <david(a)kernel.org> mm/rmap: fix two comments related to huge_pmd_unshare() David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix two comments related to huge_pmd_unshare() David Hildenbrand (Red Hat) <david(a)kernel.org> mm/hugetlb: fix hugetlb_pmd_shared() Jane Chu <jane.chu(a)oracle.com> mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Miaohe Lin <linmiaohe(a)huawei.com> mm/hugetlb: make detecting shared pte more reliable David Hildenbrand (Arm) <david(a)kernel.org> mm/hugetlb: fix skipping of unsharing of pmd page tables Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - take event lock when submitting FF request "event" Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_report() Johan Hovold <johan(a)kernel.org> wifi: rt2x00usb: fix devres lifetime Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Jens Axboe <axboe(a)kernel.dk> io_uring/tctx: work around xa_store() allocation error issue Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Cengiz Can <cengiz.can(a)canonical.com> nvmet-tcp: fix use-before-check of sg in bounds validation Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Move IRQ request in probe Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Alex Guo <alexguo1023(a)gmail.com> media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Sasha Levin <sashal(a)kernel.org> Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" David Jeffery <djeffery(a)redhat.com> scsi: core: Wake up the error handler when final completions race against each other Sasha Levin <sashal(a)kernel.org> Revert "scsi: core: Wake up the error handler when final completions race against each other" Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Add seqno waiter for sync_files Sasha Levin <sashal(a)kernel.org> Revert "drm/vmwgfx: Add seqno waiter for sync_files" Ard Biesheuvel <ardb(a)kernel.org> efi/mokvar-table: Avoid repeated map/unmap of the same page Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Loic Poulain <loic.poulain(a)linaro.org> net: qrtr: Release distant nodes along the bridge node Loic Poulain <loic.poulain(a)linaro.org> net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Davidlohr Bueso <dave(a)stgolabs.net> futex: Clear stale exiting pointer in futex_lock_pi() retry path Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> dmaengine: xilinx_dma: Program interrupt delay timeout Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error when running device stats on multiple devices fs Mark Harmstone <mark(a)harmstone.com> btrfs: fix super block offset in error message in btrfs_validate_super() Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix dma_device directions Felix Gu <ustc.gu(a)gmail.com> phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Helen Koike <koike(a)igalia.com> ext4: reject mount if bigalloc with s_first_data_block != 0 Ye Bin <yebin10(a)huawei.com> ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Jan Kara <jack(a)suse.cz> ext4: make recently_deleted() properly work with lazy itable initialization Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: convert inline data to extents when truncate exceeds inline size Milos Nikic <nikic.milos(a)gmail.com> jbd2: gracefully abort on checkpointing state corruptions Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: ses: Handle positive SCSI error from ses_recv_diag() Tyllis Xu <livelycarpet87(a)gmail.com> scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Zhan Xusheng <zhanxusheng1024(a)gmail.com> alarmtimer: Fix argument order in alarm_timer_forward() xietangxin <xietangxin(a)yeah.net> virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Yuchan Nam <entropy1110(a)gmail.com> media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: conservative: Reset requested_freq on limits change Ali Norouzi <ali.norouzi(a)keysight.com> can: gw: fix OOB heap access in cgw_csum_crc8_rel() Vasily Gorbik <gor(a)linux.ibm.com> s390/barrier: Make array_index_mask_nospec() __always_inline Marc Kleine-Budde <mkl(a)pengutronix.de> spi: spi-fsl-lpspi: fix teardown order issue (UAF) Marc Buerg <buermarc(a)googlemail.com> sysctl: fix uninitialized variable in proc_do_large_bitmap Sanman Pradhan <psanman(a)juniper.net> hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Weiming Shi <bestswngs(a)gmail.com> ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Install address space handler at the namespace root Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix ECDT probe ordering issues Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix EC address space handler unregistration Hans de Goede <hdegoede(a)redhat.com> ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Hans de Goede <hdegoede(a)redhat.com> ACPICA: include/acpi/acpixf.h: Fix indentation Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix the device initialization Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Andy Lutomirski <luto(a)kernel.org> x86/fault: Improve kernel-executing-user-memory handling Andy Lutomirski <luto(a)kernel.org> x86/fault: Fold mm_fault_error() into do_user_addr_fault() Yihang Li <liyihang9(a)huawei.com> scsi: scsi_transport_sas: Fix the maximum channel scanning issue Chuck Lever <chuck.lever(a)oracle.com> RDMA/rw: Fall back to direct SGE on MR pool exhaustion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: Synchronize cache for the page selector Paolo Valerio <pvalerio(a)redhat.com> net: macb: use the current queue number for stats David Carlier <devnexen(a)gmail.com> netfilter: ctnetlink: use netlink policy range checks Florian Westphal <fw(a)strlen.de> netlink: allow be16 and be32 types in all uint policy checks Florian Westphal <fw(a)strlen.de> netlink: introduce bigendian integer types Jakub Kicinski <kuba(a)kernel.org> netlink: hide validation union fields from kdoc Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: reject out-of-range attributes via policy Florian Westphal <fw(a)strlen.de> netlink: introduce NLA_POLICY_MAX_BE Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: skip expectations in other netns via proc Ren Wei <n05ec(a)lzu.edu.cn> netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Weiming Shi <bestswngs(a)gmail.com> netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: clamp SCO altsetting table indices Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Miguel Ojeda <ojeda(a)kernel.org> dma-mapping: add missing `inline` for `dma_free_attrs` Wei Fang <wei.fang(a)nxp.com> net: enetc: fix the output issue of 'ethtool --show-ring' Yochai Eisenrich <echelonh(a)gmail.com> net: fix fanout UAF in packet_release() via NETDEV_UP race Alok Tiwari <alok.a.tiwari(a)oracle.com> platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Qi Tang <tpluszz77(a)gmail.com> net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: validate MPLS set/set_masked payload length Toke Høiland-Jørgensen <toke(a)redhat.com> net: openvswitch: Avoid releasing netdev before teardown completes Jakub Kicinski <kuba(a)kernel.org> nfc: nci: fix circular locking dependency in nci_close_device Luca Leonardo Scorcia <l.scorcia(a)gmail.com> pinctrl: mediatek: common: Fix probe failure for devices without EINT Helen Koike <koike(a)igalia.com> Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Anas Iqbal <mohd.abd.6602(a)gmail.com> Bluetooth: hci_ll: Fix firmware leak on error path Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Oliver Hartkopp <socketcan(a)hartkopp.net> can: statistics: add missing atomic access in hot path Eric Dumazet <edumazet(a)google.com> af_key: validate families in pfkey_send_migrate() Sabrina Dubroca <sd(a)queasysnail.net> esp: fix skb leak with espintcp and async crypto Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Fix the usage of skb->sk Sabrina Dubroca <sd(a)queasysnail.net> xfrm: call xdo_dev_state_delete during state update Uzair Mughal <contact(a)uzair.is-a.dev> ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Isaac J. Manjarres <isaacmanjarres(a)google.com> dma-buf: Include ioctl.h in UAPI header Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Romain Sioen <romain.sioen(a)microchip.com> HID: mcp2221: cancel last I2C command on read error Keith Busch <kbusch(a)kernel.org> nvme-pci: ensure we're polling a polled queue Hans de Goede <johannes.goede(a)oss.qualcomm.com> platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Leif Skunberg <diamondback(a)cohunt.app> platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Günther Noack <gnoack(a)google.com> HID: asus: avoid memory leak in asus_report_fixup() Danilo Krummrich <dakr(a)kernel.org> sh: platform_early: remove pdev->driver_override check Juergen Gross <jgross(a)suse.com> xen/privcmd: add boot control for restricted usage in domU Juergen Gross <jgross(a)suse.com> xen/privcmd: restrict usage in unprivileged domU Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Josh Law <objecting(a)objecting.org> tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure Kamal Dasu <kamal.dasu(a)broadcom.com> mtd: rawnand: brcmnand: skip DMA during panic write Kamal Dasu <kdasu.kdev(a)gmail.com> mtd: rawnand: brcmnand: move to polling in pio mode on oops write Kamal Dasu <kdasu.kdev(a)gmail.com> mtd: rawnand: brcmnand: read/write oob during EDU transfer Kamal Dasu <kamal.dasu(a)broadcom.com> mtd: rawnand: serialize lock/unlock against other NAND operations Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> i2c: fsi: Fix a potential leak in fsi_i2c_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() Weiming Shi <bestswngs(a)gmail.com> icmp: fix NULL pointer dereference in icmp_tag_validation() Anas Iqbal <mohd.abd.6602(a)gmail.com> net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Weiming Shi <bestswngs(a)gmail.com> nfnetlink_osf: validate individual option lengths in fingerprints Xiang Mei <xmei5(a)asu.edu> net: bonding: fix NULL deref in bond_debug_rlb_hash_show Xiang Mei <xmei5(a)asu.edu> udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix uninitialized rx_fs_lock Guenter Roeck <linux(a)roeck-us.net> wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix NULL deref in mesh_matches_local() Kohei Enju <kohei(a)enjuk.jp> igc: fix missing update of skb->tail in igc_xmit_frame() Nikola Z. Ivanov <zlatistiv(a)gmail.com> net: usb: aqc111: Do not perform PM inside suspend callback Bart Van Assche <bvanassche(a)acm.org> PM: runtime: Fix a race condition related to device removal Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> sched: idle: Consolidate the handling of two special cases Justin Chen <justin.chen(a)broadcom.com> net: bcmgenet: increase WoL poll timeout Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: xt_time: use unsigned int for monthday bit shift Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_CT: drop pending enqueued packets on template removal Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_ct: drop pending enqueued packets on removal Andrii Melnychenko <a.melnychenko(a)vyos.io> netfilter: nft_ct: add seqadj extension for natted connections Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Lukas Johannes Möller <research(a)johannes-moeller.dev> netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Florian Westphal <fw(a)strlen.de> netfilter: ctnetlink: remove refcounting in expectation dumpers Jiayuan Chen <jiayuan.chen(a)shopee.com> net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HIDP: Fix possible UAF Christian Eggers <ceggers(a)arri.de> Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Christian Eggers <ceggers(a)arri.de> Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Christian Eggers <ceggers(a)arri.de> Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU Peddolla Harshavardhan Reddy <peddolla.reddy(a)oss.qualcomm.com> wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Richard Genoud <richard.genoud(a)bootlin.com> soc: fsl: qbman: fix race condition in qman_destroy_fq Ethan Tidmore <ethantidmore06(a)gmail.com> staging: rtl8723bs: fix null dereference in find_network Eric Biggers <ebiggers(a)kernel.org> net/tcp-md5: Fix MAC comparison to be constant-time Eric Biggers <ebiggers(a)kernel.org> smb: client: Compare MACs in constant time Mehul Rao <mehulrao(a)gmail.com> ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: pcm: fix wait_time calculations Sean Christopherson <seanjc(a)google.com> KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_can_open(): always configure bitrates before starting device Jiasheng Jiang <jiashengjiangcool(a)gmail.com> usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling Xu Yang <xu.yang_2(a)nxp.com> usb: roles: get usb role switch from parent only for usb-b-connector Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch when turning buffer off Maíra Canal <mcanal(a)igalia.com> pmdomain: bcm: bcm2835-power: Increase ASB control timeout Finn Thain <fthain(a)linux-m68k.org> mtd: Avoid boot crash in RedBoot partition table parser Corentin Labbe <clabbe(a)baylibre.com> mtd: partitions: redboot: fix style issues Jeff Layton <jlayton(a)kernel.org> nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Chuck Lever <chuck.lever(a)oracle.com> NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd Tom Rix <trix(a)redhat.com> nfsd: define exports_proc_ops with CONFIG_PROC_FS Catalin Marinas <catalin.marinas(a)arm.com> arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation Thomas Fourier <fourier.thomas(a)gmail.com> drm/msm: Fix dma_free_attrs() buffer size Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OOM ->tfm_count leak Long Li <leo.lilong(a)huawei.com> xfs: fix integer overflow in bmap intent sort comparator Long Li <leo.lilong(a)huawei.com> xfs: ensure dquot item is deleted from AIL only after log shutdown Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute Henrique Carvalho <henrique.carvalho(a)suse.com> smb: client: fix iface port assignment in parse_server_interfaces Paulo Alcantara <pc(a)manguebit.org> smb: client: fix atomic open with O_DIRECT & O_SYNC Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Maíra Canal <mcanal(a)igalia.com> pmdomain: bcm: bcm2835-power: Fix broken reset status read Huiwen He <hehuiwen(a)kylinos.cn> tracing: Fix syscall events activation by ensuring refcount hits zero Darrick J. Wong <djwong(a)kernel.org> iomap: reject delalloc mappings during writeback Heiko Carstens <hca(a)linux.ibm.com> s390/xor: Fix xor_xc_2() inline assembly constraints Paul Moses <p(a)1g4.org> net/sched: act_gate: snapshot parameters with RCU on replace Natalie Vock <natalie.vock(a)gmx.de> drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink Andrew Lunn <andrew(a)lunn.ch> net: phy: register phy led_triggers during probe to avoid AB-BA deadlock Thorsten Blum <thorsten.blum(a)linux.dev> smb: client: Don't log plaintext credentials in cifs_set_cifscreds Daniil Dulov <d.dulov(a)aladdin.ru> wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Vahagn Vardanian <vahagn(a)redrays.io> wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() Daniel Hodges <git(a)danielhodges.dev> wifi: libertas: fix use-after-free in lbs_free_adapter() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: refactor ata_scsi_translate() Hannes Reinecke <hare(a)suse.de> ata: libata: remove pointless VPRINTK() calls Brian Foster <bfoster(a)redhat.com> ext4: fix dirtyclusters double decrement on fs shutdown Zhang Yi <yi.zhang(a)huawei.com> ext4: drop extent cache when splitting extent fails Zhang Yi <yi.zhang(a)huawei.com> ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: fix to avoid directly dereferencing user pointer Jeongjun Park <aha310510(a)gmail.com> drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() Ankit Garg <nktgrg(a)google.com> gve: defer interrupt enabling until NAPI registration Frederic Weisbecker <frederic(a)kernel.org> net: Handle napi_schedule() calls from non-interrupt Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: apply state adjust rules to some additional HAINAN vairants Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Raul E Rangel <rrangel(a)chromium.org> serial: 8250: Fix TX deadlock when using DMA Martin Roukala (né Peres) <martin.roukala(a)mupuf.org> serial: 8250_pci: add support for the AX99100 Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry Chen Ni <nichen(a)iscas.ac.cn> mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Luke Wang <ziniu.wang_1(a)nxp.com> mmc: sdhci: fix timing selection for 1-bit bus width Matthew Schwartz <matthew.schwartz(a)linux.dev> mmc: sdhci-pci-gli: fix GL9750 DMA write corruption Lukas Johannes Möller <research(a)johannes-moeller.dev> Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Lukas Johannes Möller <research(a)johannes-moeller.dev> Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix use-after-free access to PTP clock Ian Ray <ian.ray(a)gehealthcare.com> NFC: nxp-nci: allow GPIOs to sleep Ira Weiny <ira.weiny(a)intel.com> nvdimm/bus: Fix potential use after free in asynchronous initialization Jeff Layton <jlayton(a)kernel.org> sunrpc: fix cache_request leak in cache_release Jens Axboe <axboe(a)kernel.dk> io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Eric Dumazet <edumazet(a)google.com> l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Forget ranges when refining tnum after JSET Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch to the same value Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: mpu3050-i2c: fix pm_runtime error handling Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: gyro: mpu3050-core: fix pm_runtime error handling Chris Spencer <spencercw(a)gmail.com> iio: chemical: bme680: Fix measurement wait duration calculation Lukas Schmid <lukas.schmid(a)netcube.li> iio: potentiometer: mcp4131: fix double application of wiper shift Oleksij Rempel <linux(a)rempel-privat.de> iio: dac: ds4424: reject -128 RAW value Filipe Manana <fdmanana(a)suse.com> btrfs: abort transaction on failure to update root in the received subvol ioctl Josh Law <objecting(a)objecting.org> lib/bootconfig: check bounds before writing in __xbc_open_brace() Josh Law <objecting(a)objecting.org> lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() Shashank Balaji <shashank.mahadasyam(a)sony.com> x86/apic: Disable x2apic on resume if the kernel expects so Josh Law <objecting(a)objecting.org> lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error Calvin Owens <calvin(a)wbinvd.org> tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Alysa Liu <Alysa.Liu(a)amd.com> drm/amdgpu: Fix use-after-free race in VM acquire Fan Wu <fanwu01(a)zju.edu.cn> net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Jian Zhang <zhangjian.3032(a)bytedance.com> net: ncsi: fix skb leak in error paths Helge Deller <deller(a)gmx.de> parisc: Fix initial page table creation for boot Dave Airlie <airlied(a)redhat.com> nouveau/dpcd: return EBUSY for aux xfer if the device is asleep Helge Deller <deller(a)gmx.de> parisc: Increase initial mapping to 64 MB with KALLSYMS Sven Eckelmann <sven(a)narfation.org> batman-adv: Avoid double-rtnl_lock ELP metric worker Ariel Silver <arielsilver77(a)gmail.com> media: dvb-net: fix OOB access in ULE extension header tables Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Luka Gejak <luka.gejak(a)linux.dev> staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie Marc Zyngier <maz(a)kernel.org> irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports Steven Rostedt <rostedt(a)goodmis.org> time/jiffies: Mark jiffies_64_to_clock_t() notrace Randy Dunlap <rdunlap(a)infradead.org> time: add kernel-doc in time.c Max Kellermann <max.kellermann(a)ionos.com> ceph: fix i_nlink underrun during async unlink Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() Mehul Rao <mehulrao(a)gmail.com> tipc: fix divide-by-zero in tipc_sk_filter_connect() Felix Gu <ustc.gu(a)gmail.com> mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() Kalesh Singh <kaleshsingh(a)google.com> mm/tracing: rss_stat: ensure curr is false from kthread context Ziyi Guo <n7l8m4(a)u.northwestern.edu> usb: image: mdc800: kill download URB on timeout Oliver Neukum <oneukum(a)suse.com> usb: mdc800: handle signal and read racing Fan Wu <fanwu01(a)zju.edu.cn> usb: renesas_usbhs: fix use-after-free in ISR during device removal Oliver Neukum <oneukum(a)suse.com> usb: class: cdc-wdm: fix reordering issue in read code path Alan Stern <stern(a)rowland.harvard.edu> USB: core: Limit the length of unkillable synchronous timeouts Alan Stern <stern(a)rowland.harvard.edu> USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts Alan Stern <stern(a)rowland.harvard.edu> USB: usbcore: Introduce usb_bulk_msg_killable() Marc Zyngier <maz(a)kernel.org> usb: cdc-acm: Restore CAP_BRK functionnality to CH343 Gabor Juhos <j4g8y7(a)gmail.com> usb: core: don't power off roothub PHYs if phy_set_mode() fails Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: misc: uss720: properly clean up reference in uss720_probe() Oliver Neukum <oneukum(a)suse.com> usb: yurex: fix race in probe Zilin Guan <zilin(a)seu.edu.cn> usb: xhci: Fix memory leak in xhci_disable_slot() Christoffer Sandberg <cs(a)tuxedo.de> usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: skip LTM configuration for LAN7850 Oleksij Rempel <linux(a)rempel-privat.de> net: usb: lan78xx: fix silent drop of packets with checksum errors Qingye Zhao <zhaoqingye(a)honor.com> cgroup: fix race between task migration and iteration Casey Connolly <casey.connolly(a)linaro.org> ASoC: detect empty DMI strings Chen Ni <nichen(a)iscas.ac.cn> ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition Ben Dooks <ben.dooks(a)codethink.co.uk> ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() Matt Vollrath <tactii(a)gmail.com> e1000/e1000e: Fix leak in DMA error cleanup Alok Tiwari <alok.a.tiwari(a)oracle.com> i40e: fix src IP mask checks and memcpy argument names in cloud filter Sungwoo Kim <iam(a)sung-woo.kim> nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> sched: idle: Make skipping governor callbacks more consistent Peng Fan <peng.fan(a)nxp.com> regulator: pca9450: Correct interrupt type Frieder Schrempf <frieder.schrempf(a)kontron.de> regulator: pca9450: Make IRQ optional Yuan Tan <tanyuan98(a)outlook.com> netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Hyunwoo Kim <imv4bel(a)gmail.com> netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path David Dull <monderasdor(a)gmail.com> netfilter: x_tables: guard option walkers against 1-byte tail reads Jenny Guanni Qu <qguanni(a)gmail.com> netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Wenyuan Li <2063309626(a)qq.com> can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> serial: caif: hold tty->link reference in ldisc_open and ser_release matteo.cotifava <cotifavamatteo(a)gmail.com> ASoC: soc-core: flush delayed work before removing DAIs and widgets Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> ASoC: core: Do not call link_exit() on uninitialized rtd objects Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: core: Exit all links before removing their components Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: don't indicate error message for snd_soc_[pcm_]dai_xxx() Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ASoC: topology: use inclusive language for bclk and fsync matteo.cotifava <cotifavamatteo(a)gmail.com> ASoC: soc-core: drop delayed_work_pending() check before flush Weiming Shi <bestswngs(a)gmail.com> net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit Gal Pressman <gal(a)nvidia.com> net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery Hangbin Liu <liuhangbin(a)gmail.com> bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states J. Neuschäfer <j.ne(a)posteo.net> powerpc: 83xx: km83xx: Fix keymile vendor prefix Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> remoteproc: sysmon: Correct subsys_name_len type in QMI request Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> powerpc/uaccess: Fix inline assembly for clang build on PPC32 Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix devices attaching to different hosts Sofia Schneider <sofia(a)schn.dev> ACPI: OSI: Add DMI quirk for Acer Aspire One D255 Al Viro <viro(a)zeniv.linux.org.uk> unshare: fix unshare_fs() handling Piotr Mazek <pmazek(a)outlook.com> ACPI: PM: Save NVS memory on Lenovo G70-35 Jan Kiszka <jan.kiszka(a)siemens.com> scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Jiayuan Chen <jiayuan.chen(a)shopee.com> net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Fernando Fernandez Mancera <fmancera(a)suse.de> net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled Fernando Fernandez Mancera <fmancera(a)suse.de> net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled Jakub Kicinski <kuba(a)kernel.org> nfc: rawsock: cancel tx_work before socket teardown Jakub Kicinski <kuba(a)kernel.org> nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Jakub Kicinski <kuba(a)kernel.org> nfc: nci: free skb on nci_transceive early error paths Ian Ray <ian.ray(a)gehealthcare.com> net: nfc: nci: Fix zero-length proprietary notifications Raju Rangoju <Raju.Rangoju(a)amd.com> amd-xgbe: fix sleep while atomic on suspend/resume Jakub Kicinski <kuba(a)kernel.org> ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() David Thomson <dt(a)linux-mail.net> xen/acpi-processor: fix _CST detection using undersized evaluation buffer Eric Dumazet <edumazet(a)google.com> indirect_call_wrapper: do not reevaluate function pointer Bart Van Assche <bvanassche(a)acm.org> wifi: wlcore: Fix a locking bug Bart Van Assche <bvanassche(a)acm.org> wifi: cw1200: Fix locking in error paths Alban Bedel <alban.bedel(a)lht.dlh.de> can: mcp251x: fix deadlock in error path of mcp251x_open Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix locking for bcm_op runtime updates Jiayuan Chen <jiayuan.chen(a)shopee.com> atm: lec: fix null-ptr-deref in lec_arp_clear_vccs Chintan Vankar <c-vankar(a)ti.com> net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table Jonathan Teh <jonathan.teh(a)outlook.com> platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Paolo Abeni <pabeni(a)redhat.com> selftests: mptcp: more stable simult_flows tests Lars Ellenberg <lars.ellenberg(a)linbit.com> drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Phillip Lougher <phillip(a)squashfs.org.uk> Squashfs: check metadata block offset is within range Davide Caratti <dcaratti(a)redhat.com> net/sched: ets: fix divide by zero in the offload path Jason Gunthorpe <jgg(a)ziepe.ca> IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Johannes Berg <johannes.berg(a)intel.com> wifi: radiotap: reject radiotap with unknown bits Jun Seo <jun.seo.93(a)proton.me> ALSA: usb-audio: Use correct version for UAC3 header validation Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: defer freeing of boot services memory Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> can: ucan: Fix infinite loop from zero-length messages Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: pegasus: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: kalmia: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: kaweth: validate USB endpoints Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nfc: pn533: properly drop the usb interface reference on disconnect Jens Axboe <axboe(a)kernel.dk> media: dvb-core: fix wrong reinitialization of ringbuffer on reopen Ethan Nelson-Moore <enelsonmoore(a)gmail.com> net: arcnet: com20020-pci: fix support for 2.5Mbit cards Takashi Iwai <tiwai(a)suse.de> ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Gui-Dong Han <hanguidong02(a)gmail.com> hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Takashi Iwai <tiwai(a)suse.de> ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 Johan Hovold <johan(a)kernel.org> clk: tegra: tegra124-emc: fix device leak on set_rate() Johan Hovold <johan(a)kernel.org> bus: omap-ocp2scp: fix OF populate on driver rebind Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> bus: omap-ocp2scp: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> drm/tegra: dsi: fix device leak on probe Gui-Dong Han <hanguidong02(a)gmail.com> bus: fsl-mc: fix use-after-free in driver_override_show() Chelsy Ratnawat <chelsyratnawat2001(a)gmail.com> bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions Wentao Liang <vulab(a)iscas.ac.cn> ARM: omap2: Fix reference count leaks in omap_control_init() Wang Qing <wangqing(a)vivo.com> ARM: OMAP2+: add missing of_node_put before break and return Mark Harmstone <mark(a)harmstone.com> btrfs: fix incorrect key offset in error message in check_dev_extent_item() Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Cap the packet size pre-calculations Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Mathias Krause <minipli(a)grsecurity.net> scsi: lpfc: Properly set WC for DPP mapping Ben Hutchings <ben(a)decadent.org.uk> ip6_tunnel: Fix usage of skb_vlan_inet_prepare() Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> ARM: clean up the memset64() C wrapper ------------- Diffstat: Documentation/hwmon/adm1177.rst | 8 +- Makefile | 4 +- arch/arm/include/asm/string.h | 14 +- arch/arm/mach-omap2/cm_common.c | 8 +- arch/arm/mach-omap2/control.c | 29 +- arch/arm/mach-omap2/prm_common.c | 8 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/mips/lib/multi3.c | 6 +- arch/parisc/include/asm/pgtable.h | 2 +- arch/parisc/kernel/head.S | 7 +- arch/powerpc/include/asm/uaccess.h | 2 +- arch/powerpc/platforms/83xx/km83xx.c | 4 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/entry.S | 7 +- arch/s390/lib/xor.c | 4 +- arch/sh/drivers/platform_early.c | 4 - arch/x86/include/asm/efi.h | 2 +- arch/x86/kernel/apic/apic.c | 6 + arch/x86/kvm/svm/avic.c | 2 +- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/mm/fault.c | 118 +++---- arch/x86/platform/efi/efi.c | 2 +- arch/x86/platform/efi/quirks.c | 55 +++- crypto/af_alg.c | 4 +- drivers/acpi/acpica/evxfregn.c | 92 +++++- drivers/acpi/ec.c | 49 ++- drivers/acpi/osi.c | 13 + drivers/acpi/osl.c | 2 +- drivers/acpi/sleep.c | 8 + drivers/ata/libata-core.c | 3 - drivers/ata/libata-sata.c | 2 - drivers/ata/libata-scsi.c | 123 +++----- drivers/ata/libata-sff.c | 4 - drivers/ata/libata.h | 1 - drivers/base/power/runtime.c | 1 + drivers/base/property.c | 205 ++++++++---- drivers/base/regmap/regmap.c | 30 +- drivers/block/drbd/drbd_actlog.c | 53 ++-- drivers/block/drbd/drbd_interval.h | 5 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/bus/fsl-mc/fsl-mc-bus.c | 10 +- drivers/bus/omap-ocp2scp.c | 19 +- drivers/clk/tegra/clk-tegra124-emc.c | 2 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 13 +- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpuidle/cpuidle.c | 10 - drivers/crypto/atmel-sha204a.c | 5 +- drivers/dma/xilinx/xilinx_dma.c | 66 ++-- drivers/firmware/efi/mokvar-table.c | 20 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +- drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 72 ++++- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/gpu/drm/msm/msm_gpummu.c | 2 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 +- drivers/hid/hid-asus.c | 15 +- drivers/hid/hid-cmedia.c | 2 +- drivers/hid/hid-creative-sb0540.c | 2 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/hid-multitouch.c | 7 + drivers/hid/hid-zydacron.c | 2 +- drivers/hid/wacom_wac.c | 10 + drivers/hwmon/adm1177.c | 54 ++-- drivers/hwmon/max16065.c | 26 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/isl68137.c | 7 +- drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/i2c/busses/i2c-fsi.c | 1 + drivers/iio/chemical/bme680_core.c | 2 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/dac/ds4424.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 50 ++- drivers/iio/gyro/mpu3050-i2c.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/potentiometer/mcp4131.c | 2 +- drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/mthca/mthca_provider.c | 5 +- drivers/input/joystick/xpad.c | 2 + drivers/input/misc/uinput.c | 35 ++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/iommu/intel/dmar.c | 3 +- drivers/irqchip/irq-gic-v3-its.c | 4 + drivers/media/dvb-core/dmxdev.c | 4 +- drivers/media/dvb-core/dvb_net.c | 3 + drivers/media/dvb-frontends/dib7000p.c | 10 +- drivers/media/mc/mc-request.c | 5 + drivers/media/usb/uvc/uvc_ctrl.c | 33 +- drivers/media/usb/uvc/uvc_driver.c | 234 ++++++++++++-- drivers/media/usb/uvc/uvc_entity.c | 1 + drivers/media/usb/uvc/uvcvideo.h | 27 +- drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/mmc/core/block.c | 2 +- drivers/mmc/core/core.c | 110 +------ drivers/mmc/host/mmci_qcom_dml.c | 1 + drivers/mmc/host/sdhci-pci-gli.c | 9 + drivers/mmc/host/sdhci.c | 9 +- drivers/mmc/host/vub300.c | 2 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 63 +++- drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 14 +- drivers/mtd/parsers/redboot.c | 71 +++-- drivers/net/arcnet/com20020-pci.c | 16 +- drivers/net/bonding/bond_debugfs.c | 16 +- drivers/net/bonding/bond_main.c | 8 +- drivers/net/caif/caif_serial.c | 3 + drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/spi/mcp251x.c | 15 +- drivers/net/can/usb/ems_usb.c | 7 +- drivers/net/can/usb/gs_usb.c | 13 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/dsa/bcm_sf2.c | 8 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 - drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 - drivers/net/ethernet/amd/xgbe/xgbe.h | 3 - drivers/net/ethernet/arc/emac_main.c | 11 + drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +- drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 18 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/cadence/macb_ptp.c | 4 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_main.c | 5 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 - drivers/net/ethernet/intel/e1000e/netdev.c | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +- drivers/net/ethernet/intel/igc/igc_main.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/ethernet/ti/cpsw_ale.c | 9 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/phy/phy_device.c | 13 +- drivers/net/usb/aqc111.c | 12 +- drivers/net/usb/kalmia.c | 7 + drivers/net/usb/kaweth.c | 13 + drivers/net/usb/lan78xx.c | 8 +- drivers/net/usb/lan78xx.h | 3 + drivers/net/usb/pegasus.c | 13 +- drivers/net/virtio_net.c | 1 + drivers/net/vxlan/vxlan_core.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 4 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/net/wireless/st/cw1200/pm.c | 2 + drivers/net/wireless/ti/wlcore/main.c | 4 +- drivers/net/wireless/ti/wlcore/tx.c | 2 +- drivers/nfc/nxp-nci/i2c.c | 4 +- drivers/nfc/pn533/uart.c | 14 +- drivers/nfc/pn533/usb.c | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 5 +- drivers/nvme/target/tcp.c | 6 +- drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/phy/renesas/phy-rcar-gen3-usb2.c | 122 +++++--- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/intel-hid.c | 7 + drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/platform/x86/touchscreen_dmi.c | 18 ++ drivers/regulator/pca9450-regulator.c | 41 ++- drivers/remoteproc/qcom_sysmon.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 12 +- drivers/s390/crypto/zcrypt_cex4.c | 3 +- drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 36 ++- drivers/scsi/lpfc/lpfc_sli4.h | 3 + drivers/scsi/scsi_lib.c | 3 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 7 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/scsi/ufs/ufshcd.c | 18 +- drivers/soc/bcm/bcm2835-power.c | 33 +- drivers/soc/fsl/qbman/qman.c | 24 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/staging/comedi/drivers.c | 8 + drivers/staging/comedi/drivers/dt2815.c | 12 + drivers/staging/comedi/drivers/me4000.c | 16 +- drivers/staging/comedi/drivers/me_daq.c | 35 ++- drivers/staging/comedi/drivers/ni_atmio16d.c | 3 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 16 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 13 +- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 15 + drivers/tty/serial/8250/8250_pci.c | 17 + drivers/tty/serial/8250/8250_port.c | 6 + drivers/usb/class/cdc-acm.c | 14 + drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/class/usbtmc.c | 9 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/message.c | 97 ++++-- drivers/usb/core/phy.c | 8 +- drivers/usb/core/quirks.c | 7 + drivers/usb/gadget/function/f_hid.c | 11 +- drivers/usb/gadget/function/f_rndis.c | 3 + drivers/usb/gadget/function/f_subset.c | 7 + drivers/usb/gadget/function/f_tcm.c | 14 + drivers/usb/gadget/function/f_uac1_legacy.c | 47 ++- drivers/usb/gadget/function/f_uvc.c | 46 ++- drivers/usb/gadget/function/u_ether.c | 8 +- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 13 +- drivers/usb/gadget/udc/dummy_hcd.c | 13 +- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci.c | 4 +- drivers/usb/image/mdc800.c | 6 +- drivers/usb/misc/uss720.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/renesas_usbhs/common.c | 9 + drivers/usb/roles/class.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/xen/privcmd.c | 76 ++++- drivers/xen/xen-acpi-processor.c | 7 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 3 +- fs/btrfs/tree-checker.c | 2 +- fs/btrfs/volumes.c | 5 +- fs/ceph/dir.c | 15 +- fs/cifs/cifsencrypt.c | 3 +- fs/cifs/cifsglob.h | 11 + fs/cifs/connect.c | 1 - fs/cifs/dir.c | 1 + fs/cifs/file.c | 17 +- fs/cifs/smb2ops.c | 18 +- fs/cifs/smb2transport.c | 4 +- fs/ext4/extents.c | 22 +- fs/ext4/fast_commit.c | 17 +- fs/ext4/ialloc.c | 6 + fs/ext4/inode.c | 27 +- fs/ext4/mballoc.c | 37 +-- fs/ext4/super.c | 13 +- fs/iomap/buffered-io.c | 7 +- fs/jbd2/checkpoint.c | 15 +- fs/nfsd/nfs4xdr.c | 9 +- fs/nfsd/nfsctl.c | 31 +- fs/nfsd/state.h | 17 +- fs/squashfs/cache.c | 3 + fs/xfs/xfs_bmap_item.c | 3 +- fs/xfs/xfs_dquot.c | 8 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- include/acpi/acpixf.h | 138 +++++---- include/asm-generic/tlb.h | 77 ++++- include/linux/dma-mapping.h | 4 +- include/linux/fwnode.h | 10 +- include/linux/hugetlb.h | 17 +- include/linux/indirect_call_wrapper.h | 18 +- include/linux/irqchip/arm-gic-v3.h | 1 + include/linux/mm_types.h | 2 + include/linux/mmc/host.h | 12 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/property.h | 5 +- include/linux/security.h | 1 + include/linux/swapops.h | 6 + include/linux/usb.h | 8 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + include/net/netfilter/nf_tables.h | 5 + include/net/netlink.h | 39 ++- include/net/tc_act/tc_gate.h | 33 +- include/net/udp_tunnel.h | 2 +- include/sound/soc-dai.h | 85 ++++- include/sound/soc.h | 2 + include/trace/events/kmem.h | 8 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + include/uapi/sound/asoc.h | 22 +- io_uring/io-wq.c | 2 +- io_uring/io_uring.c | 39 ++- kernel/bpf/verifier.c | 11 +- kernel/cgroup/cgroup.c | 1 + kernel/fork.c | 2 +- kernel/futex/core.c | 3 +- kernel/sched/idle.c | 39 ++- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/time/time.c | 171 +++++++++- kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 51 ++- lib/bootconfig.c | 6 +- lib/crypto/chacha.c | 4 + lib/nlattr.c | 22 ++ mm/hugetlb.c | 143 ++++----- mm/mmu_gather.c | 36 +++ mm/rmap.c | 20 +- net/atm/lec.c | 98 +++--- net/atm/lec.h | 2 +- net/batman-adv/bat_iv_ogm.c | 3 + net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/hard-interface.c | 8 +- net/batman-adv/hard-interface.h | 1 + net/batman-adv/translation-table.c | 9 +- net/bluetooth/hidp/core.c | 16 +- net/bluetooth/l2cap_core.c | 55 +++- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 3 + net/bluetooth/smp.c | 13 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/bridge/br_device.c | 2 +- net/bridge/br_input.c | 2 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/bcm.c | 1 + net/can/gw.c | 6 +- net/can/proc.c | 3 +- net/ceph/auth.c | 6 +- net/core/dev.c | 2 +- net/core/rtnetlink.c | 9 +- net/ipv4/esp4.c | 11 +- net/ipv4/icmp.c | 4 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/esp6.c | 11 +- net/ipv6/icmp.c | 3 + net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 7 +- net/ipv6/ndisc.c | 3 + net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 11 +- net/ipv6/seg6_iptunnel.c | 34 +- net/ipv6/tcp_ipv6.c | 5 +- net/ipv6/xfrm6_output.c | 4 +- net/key/af_key.c | 19 +- net/l2tp/l2tp_ppp.c | 25 +- net/mac80211/mesh.c | 6 + net/ncsi/ncsi-aen.c | 3 +- net/ncsi/ncsi-rsp.c | 16 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 89 +++--- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 20 +- net/netfilter/nf_tables_api.c | 12 +- net/netfilter/nfnetlink_cthelper.c | 8 +- net/netfilter/nfnetlink_log.c | 10 +- net/netfilter/nfnetlink_osf.c | 13 + net/netfilter/nfnetlink_queue.c | 4 +- net/netfilter/nft_ct.c | 11 +- net/netfilter/nft_payload.c | 6 +- net/netfilter/nft_set_pipapo.c | 46 ++- net/netfilter/nft_set_pipapo.h | 2 + net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_CT.c | 4 + net/netfilter/xt_IDLETIMER.c | 6 + net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_dccp.c | 4 +- net/netfilter/xt_rateest.c | 5 + net/netfilter/xt_tcpudp.c | 6 +- net/netfilter/xt_time.c | 4 +- net/nfc/nci/core.c | 31 +- net/nfc/nci/data.c | 12 +- net/nfc/rawsock.c | 11 + net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 9 +- net/packet/af_packet.c | 1 + net/qrtr/af_qrtr.c | 66 ++-- net/rds/ib_rdma.c | 7 +- net/rfkill/core.c | 40 ++- net/rose/af_rose.c | 5 + net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/key.c | 2 +- net/sched/act_gate.c | 264 +++++++++++----- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_ets.c | 12 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_teql.c | 1 + net/smc/smc_rx.c | 9 +- net/sunrpc/cache.c | 26 +- net/tipc/group.c | 6 +- net/tipc/socket.c | 2 + net/wireless/core.c | 1 + net/wireless/pmsr.c | 1 + net/wireless/radiotap.c | 4 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 1 + security/apparmor/apparmorfs.c | 228 ++++++++------ security/apparmor/include/label.h | 16 +- security/apparmor/include/lib.h | 12 + security/apparmor/include/match.h | 1 + security/apparmor/include/policy.h | 13 +- security/apparmor/include/policy_ns.h | 2 + security/apparmor/include/policy_unpack.h | 83 +++-- security/apparmor/label.c | 12 +- security/apparmor/match.c | 58 +++- security/apparmor/policy.c | 82 ++++- security/apparmor/policy_ns.c | 2 + security/apparmor/policy_unpack.c | 74 +++-- security/security.c | 1 + sound/core/pcm_lib.c | 11 +- sound/core/pcm_native.c | 25 +- sound/pci/ctxfi/ctdaio.c | 1 + sound/pci/hda/patch_conexant.c | 11 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/acp3x-rt5682-max9836.c | 9 +- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/meson/meson-codec-glue.c | 3 - sound/soc/soc-core.c | 344 +++++++++++++++------ sound/soc/soc-dai.c | 63 ++++ sound/soc/soc-dapm.c | 24 +- sound/soc/soc-pcm.c | 10 +- sound/soc/soc-topology.c | 24 +- sound/soc/soc-utils.c | 29 ++ sound/soc/sof/topology.c | 6 +- sound/soc/tegra/tegra_pcm.c | 3 + sound/usb/caiaq/device.c | 2 +- sound/usb/endpoint.c | 3 + sound/usb/validate.c | 2 +- tools/bootconfig/main.c | 7 +- tools/objtool/check.c | 5 +- tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +- 458 files changed, 5215 insertions(+), 2261 deletions(-)

1 month

9
9
0 0

[PATCH 6.1 000/312] 6.1.168-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.168 release. There are 312 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.168-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.168-rc1 Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Evaluate orphan _REG under EC device Nathan Chancellor <nathan(a)kernel.org> ext4: fix unused iterator variable warnings Theodore Ts'o <tytso(a)mit.edu> ext4: fix lost error code reporting in __ext4_fill_super() Bart Van Assche <bvanassche(a)acm.org> block: Fix the blk_mq_destroy_queue() documentation Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: eir: Fix possible crashes on eir_create_adv_data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: check removing signal+subflow endp Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: implicit: stop transfer after last check Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix unlikely race in gdlm_put_lock Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: phy: fix phy_uses_state_machine() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY Vladimir Oltean <vladimir.oltean(a)nxp.com> net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: save ailp before dropping the AIL lock in push callbacks Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: avoid dereferencing log items after push callbacks Denis Arefev <arefev(a)swemel.ru> erofs: Fix the slab-out-of-bounds in drop_buffers() Gao Xiang <xiang(a)kernel.org> erofs: fix PSI memstall accounting Gao Xiang <xiang(a)kernel.org> erofs: handle overlapped pclusters out of crafted images properly Pratyush Yadav <p.yadav(a)ti.com> mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode Pratyush Yadav <p.yadav(a)ti.com> mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang <liaochang1(a)huawei.com> cpufreq: governor: Free dbs_data directly when gov->init() fails Theodore Ts'o <tytso(a)mit.edu> ext4: handle wraparound when searching for blocks for indirect mapped blocks Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Zqiang <qiang.zhang(a)linux.dev> ext4: fix the might_sleep() warnings in kvfree() Jason Yan <yanaijie(a)huawei.com> ext4: factor out ext4_flex_groups_free() Jason Yan <yanaijie(a)huawei.com> ext4: use ext4_group_desc_free() in ext4_put_super() to save some duplicated code Jason Yan <yanaijie(a)huawei.com> ext4: factor out ext4_percpu_param_init() and ext4_percpu_param_destroy() Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes Eddie James <eajames(a)linux.ibm.com> hwmon: (pmbus/core) Add lock and unlock functions Luo Haiyang <luo.haiyang(a)zte.com.cn> tracing: Fix potential deadlock in cpu hotplug with osnoise Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix potencial OOB in get_file_all_info() for compound requests Werner Kasselman <werner(a)verivus.com> ksmbd: fix memory leaks and NULL deref in smb2_lock() Nikunj A Dadhania <nikunj(a)amd.com> x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE Zheng Qixing <zhengqixing(a)huawei.com> block: fix resource leak in blk_register_queue() error path Jiayuan Chen <jiayuan.chen(a)shopee.com> ext4: fix use-after-free in update_super_work when racing with umount Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: fix PF !of_device_is_available() teardown path Josh Law <objecting(a)objecting.org> mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Ming Lei <ming.lei(a)redhat.com> nvme: fix admin queue leak on controller reset Keith Busch <kbusch(a)kernel.org> nvme: fix admin request_queue lifetime Christoph Hellwig <hch(a)lst.de> nvme-pci: put the admin queue in nvme_dev_remove_admin Christoph Hellwig <hch(a)lst.de> nvme-pci: remove an extra queue reference Christoph Hellwig <hch(a)lst.de> blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue Heyne, Maximilian <mheyne(a)amazon.de> Revert "nvme: fix admin request_queue lifetime" Filipe Manana <fdmanana(a)suse.com> btrfs: do not free data reservation in fallback from inline due to -ENOSPC Qu Wenruo <wqu(a)suse.com> btrfs: fix the qgroup data free range for inline data extents Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Sasha Levin <sashal(a)kernel.org> Revert "ext4: make ext4_es_remove_extent() return void" Sasha Levin <sashal(a)kernel.org> Revert "ext4: get rid of ppath in ext4_find_extent()" Sasha Levin <sashal(a)kernel.org> Revert "ext4: get rid of ppath in ext4_ext_create_new_leaf()" Sasha Levin <sashal(a)kernel.org> Revert "ext4: get rid of ppath in ext4_ext_insert_extent()" Sasha Levin <sashal(a)kernel.org> Revert "ext4: get rid of ppath in ext4_split_extent_at()" Sasha Levin <sashal(a)kernel.org> Revert "ext4: subdivide EXT4_EXT_DATA_VALID1" Sasha Levin <sashal(a)kernel.org> Revert "ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1" Sasha Levin <sashal(a)kernel.org> Revert "ext4: drop extent cache after doing PARTIAL_VALID1 zeroout" Sasha Levin <sashal(a)kernel.org> Revert "ext4: drop extent cache when splitting extent fails" Sasha Levin <sashal(a)kernel.org> Revert "ext4: avoid infinite loops caused by residual data" Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> netfilter: Reorder fields in 'struct nf_conntrack_expect' Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Alexander Sverdlin <alexander.sverdlin(a)gmail.com> ASoC: ep93xx: i2s: move enable call to startup callback Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. Davidlohr Bueso <dave(a)stgolabs.net> futex: Clear stale exiting pointer in futex_lock_pi() retry path Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> dmaengine: xilinx_dma: Program interrupt delay timeout Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix freeing the allocated ida too late Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error when running device stats on multiple devices fs Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> btrfs: fix leak of kobject name for sub-group space_info Mark Harmstone <mark(a)harmstone.com> btrfs: fix super block offset in error message in btrfs_validate_super() Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix dma_device directions Felix Gu <ustc.gu(a)gmail.com> phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix memory leak when a wq is reset Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off Theodore Ts'o <tytso(a)mit.edu> ext4: always drain queued discard work in ext4_mb_release() Baokun Li <libaokun(a)linux.alibaba.com> ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Helen Koike <koike(a)igalia.com> ext4: reject mount if bigalloc with s_first_data_block != 0 Ye Bin <yebin10(a)huawei.com> ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Edward Adam Davis <eadavis(a)qq.com> ext4: avoid infinite loops caused by residual data Jan Kara <jack(a)suse.cz> ext4: make recently_deleted() properly work with lazy itable initialization Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: convert inline data to extents when truncate exceeds inline size Simon Weber <simon.weber.39(a)gmail.com> ext4: fix journal credit check when setting fscrypt context Long Li <leo.lilong(a)huawei.com> xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: stop reclaim before pushing AIL during unmount Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Workaround LS2K/LS7A GPU DMA hang bug Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Protect the driver specific lists Jassi Brar <jassisinghbrar(a)gmail.com> irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment Milos Nikic <nikic.milos(a)gmail.com> jbd2: gracefully abort on checkpointing state corruptions Kevin Hao <haokexin(a)gmail.com> net: macb: Use dev_consume_skb_any() to free TX SKBs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: ses: Handle positive SCSI error from ses_recv_diag() Tyllis Xu <livelycarpet87(a)gmail.com> scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Zhan Xusheng <zhanxusheng1024(a)gmail.com> alarmtimer: Fix argument order in alarm_timer_forward() Jiucheng Xu <jiucheng.xu(a)amlogic.com> erofs: add GFP_NOIO in the bio completion if needed xietangxin <xietangxin(a)yeah.net> virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Yuchan Nam <entropy1110(a)gmail.com> media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature Marc Zyngier <maz(a)kernel.org> KVM: arm64: Discard PC update state on vcpu reset Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: conservative: Reset requested_freq on limits change Ali Norouzi <ali.norouzi(a)keysight.com> can: gw: fix OOB heap access in cgw_csum_crc8_rel() Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: do not expire session on binding failure Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() Vasily Gorbik <gor(a)linux.ibm.com> s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> s390/syscalls: Add spectre boundary for syscall dispatch table Marc Kleine-Budde <mkl(a)pengutronix.de> spi: spi-fsl-lpspi: fix teardown order issue (UAF) Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix clock leak on PLL lock failure Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix unchecked clk_prepare_enable() return value Marc Buerg <buermarc(a)googlemail.com> sysctl: fix uninitialized variable in proc_do_large_bitmap Sanman Pradhan <psanman(a)juniper.net> hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib Weiming Shi <bestswngs(a)gmail.com> ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: EC: Install address space handler at the namespace root Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix ECDT probe ordering issues Hans de Goede <hdegoede(a)redhat.com> ACPI: EC: Fix EC address space handler unregistration Hans de Goede <hdegoede(a)redhat.com> ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Hans de Goede <hdegoede(a)redhat.com> ACPICA: include/acpi/acpixf.h: Fix indentation Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix the device initialization Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Yihang Li <liyihang9(a)huawei.com> scsi: scsi_transport_sas: Fix the maximum channel scanning issue Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Return EINVAL for invalid arp index error Anil Samal <anil.samal(a)intel.com> RDMA/irdma: Fix deadlock during netdev reset with active connections Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() Ivan Barrera <ivan.d.barrera(a)intel.com> RDMA/irdma: Clean up unnecessary dereference of event->cm_node Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Update ibqp state to error if QP is already in error state Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Initialize free_qp completion before using it Chuck Lever <chuck.lever(a)oracle.com> RDMA/rw: Fall back to direct SGE on MR pool exhaustion Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: Synchronize cache for the page selector Paolo Valerio <pvalerio(a)redhat.com> net: macb: use the current queue number for stats David Carlier <devnexen(a)gmail.com> netfilter: ctnetlink: use netlink policy range checks Florian Westphal <fw(a)strlen.de> netlink: allow be16 and be32 types in all uint policy checks Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: skip expectations in other netns via proc Ren Wei <n05ec(a)lzu.edu.cn> netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Weiming Shi <bestswngs(a)gmail.com> netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Chuck Lever <chuck.lever(a)oracle.com> tls: Purge async_hold in tls_decrypt_async_wait() Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: clamp SCO altsetting table indices Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Zhang Chen <zhangchen01(a)kylinos.cn> Bluetooth: L2CAP: Fix send LE flow credits in ACL link Miguel Ojeda <ojeda(a)kernel.org> dma-mapping: add missing `inline` for `dma_free_attrs` Wei Fang <wei.fang(a)nxp.com> net: enetc: fix the output issue of 'ethtool --show-ring' Martin KaFai Lau <martin.lau(a)kernel.org> udp: Fix wildcard bind conflict check when using hash2 Eric Dumazet <edumazet(a)google.com> tcp: optimize inet_use_bhash2_on_bind() Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Rearrange tests in inet_csk_bind_conflict(). Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. Yochai Eisenrich <echelonh(a)gmail.com> net: fix fanout UAF in packet_release() via NETDEV_UP race Petr Oros <poros(a)redhat.com> ice: use ice_update_eth_stats() for representor stats Alok Tiwari <alok.a.tiwari(a)oracle.com> platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Qi Tang <tpluszz77(a)gmail.com> net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: validate MPLS set/set_masked payload length Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: defer tunnel netdev_put to RCU release Hangbin Liu <liuhangbin(a)gmail.com> rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link Hangbin Liu <liuhangbin(a)gmail.com> net: add new helper unregister_netdevice_many_notify Hangbin Liu <liuhangbin(a)gmail.com> rtnetlink: pass netlink message header and portid to rtnl_configure_link() Toke Høiland-Jørgensen <toke(a)redhat.com> net: openvswitch: Avoid releasing netdev before teardown completes Jakub Kicinski <kuba(a)kernel.org> nfc: nci: fix circular locking dependency in nci_close_device Mohammad Heib <mheib(a)redhat.com> ionic: fix persistent MAC address override on PF Luca Leonardo Scorcia <l.scorcia(a)gmail.com> pinctrl: mediatek: common: Fix probe failure for devices without EINT Helen Koike <koike(a)igalia.com> Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Anas Iqbal <mohd.abd.6602(a)gmail.com> Bluetooth: hci_ll: Fix firmware leak on error path Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Oliver Hartkopp <socketcan(a)hartkopp.net> can: statistics: add missing atomic access in hot path Shigeru Yoshida <syoshida(a)redhat.com> dma: swiotlb: add KMSAN annotations to swiotlb_bounce() Eric Dumazet <edumazet(a)google.com> af_key: validate families in pfkey_send_migrate() Sabrina Dubroca <sd(a)queasysnail.net> esp: fix skb leak with espintcp and async crypto Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Fix the usage of skb->sk Sabrina Dubroca <sd(a)queasysnail.net> xfrm: call xdo_dev_state_delete during state update Jie Deng <dengjie03(a)kylinos.cn> usb: core: new quirk to handle devices with zero configurations Uzair Mughal <contact(a)uzair.is-a.dev> ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Liucheng Lu <luliucheng100(a)outlook.com> ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk Boris Burkov <boris(a)bur.io> btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create Günther Noack <gnoack(a)google.com> HID: apple: avoid memory leak in apple_report_fixup() Isaac J. Manjarres <isaacmanjarres(a)google.com> dma-buf: Include ioctl.h in UAPI header Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Ihor Solodrai <ihor.solodrai(a)linux.dev> module: Fix kernel panic when a symbol st_shndx is out of bounds Romain Sioen <romain.sioen(a)microchip.com> HID: mcp2221: cancel last I2C command on read error Valentin Spreckels <valentin(a)spreckels.dev> net: usb: r8152: add TRENDnet TUC-ET2G Günther Noack <gnoack(a)google.com> HID: magicmouse: avoid memory leak in magicmouse_report_fixup() Julius Lehmann <lehmanju(a)devpi.de> HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 Keith Busch <kbusch(a)kernel.org> nvme-pci: ensure we're polling a polled queue Hans de Goede <johannes.goede(a)oss.qualcomm.com> platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Leif Skunberg <diamondback(a)cohunt.app> platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Daniel Hodges <hodgesd(a)meta.com> nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Keith Busch <kbusch(a)kernel.org> nvme-pci: cap queue creation to used queues Peter Metz <peter.metz(a)unarin.com> platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list Günther Noack <gnoack(a)google.com> HID: asus: avoid memory leak in asus_report_fixup() Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Release module BTF IDR before module unload Danilo Krummrich <dakr(a)kernel.org> sh: platform_early: remove pdev->driver_override check ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 4 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++ arch/arm64/kvm/reset.c | 14 + arch/loongarch/pci/pci.c | 80 ++++++ arch/mips/lib/multi3.c | 6 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 23 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/syscall.c | 2 + arch/sh/drivers/platform_early.c | 4 - arch/x86/kernel/cpu/common.c | 18 +- arch/x86/kvm/mmu/mmu.c | 15 +- arch/x86/platform/efi/quirks.c | 2 +- block/blk-mq.c | 9 +- block/blk-sysfs.c | 2 + block/bsg-lib.c | 2 + crypto/af_alg.c | 4 +- drivers/acpi/acpica/acevents.h | 4 + drivers/acpi/acpica/evregion.c | 6 +- drivers/acpi/acpica/evxfregn.c | 146 +++++++++- drivers/acpi/ec.c | 52 +++- drivers/base/regmap/regmap.c | 30 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 13 +- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/dma/idxd/cdev.c | 10 +- drivers/dma/idxd/device.c | 3 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 +++-- drivers/dma/xilinx/xilinx_dma.c | 66 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/hid/hid-apple.c | 4 +- drivers/hid/hid-asus.c | 15 +- drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 + drivers/hwmon/adm1177.c | 54 ++-- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/isl68137.c | 21 +- drivers/hwmon/pmbus/pmbus.h | 2 + drivers/hwmon/pmbus/pmbus_core.c | 30 ++ drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/adc/ti-adc161s626.c | 41 ++- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/input/joystick/xpad.c | 2 + drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/media/mc/mc-request.c | 5 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/mtd/spi-nor/core.c | 145 +++++++++- drivers/net/can/vxcan.c | 2 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_main.c | 17 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/geneve.c | 2 +- drivers/net/phy/phy_device.c | 58 +++- drivers/net/usb/r8152.c | 1 + drivers/net/veth.c | 2 +- drivers/net/virtio_net.c | 1 + drivers/net/vxlan/vxlan_core.c | 10 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virt_wifi.c | 1 - drivers/net/wwan/wwan_core.c | 2 +- drivers/nfc/pn533/uart.c | 3 + drivers/nvme/host/apple.c | 1 + drivers/nvme/host/core.c | 16 +- drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 25 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/intel/hid.c | 13 + drivers/platform/x86/touchscreen_dmi.c | 18 ++ drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/scsi_sysfs.c | 1 + drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/target/loopback/tcm_loop.c | 52 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/ufs/core/ufshcd.c | 2 + drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 8 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_rndis.c | 9 +- drivers/usb/gadget/function/f_subset.c | 6 + drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++- drivers/usb/gadget/function/f_uvc.c | 39 ++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/inode.c | 6 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/volumes.c | 5 +- fs/btrfs/zoned.c | 6 +- fs/erofs/data.c | 2 + fs/erofs/zdata.c | 70 ++--- fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 10 +- fs/ext4/extents.c | 312 +++++++++------------ fs/ext4/extents_status.c | 12 +- fs/ext4/extents_status.h | 4 +- fs/ext4/fast_commit.c | 25 +- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 12 +- fs/ext4/inode.c | 35 ++- fs/ext4/mballoc.c | 30 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 7 +- fs/ext4/super.c | 164 +++++------ fs/ext4/sysfs.c | 10 +- fs/gfs2/lock_dlm.c | 10 +- fs/jbd2/checkpoint.c | 15 +- fs/smb/server/smb2pdu.c | 72 +++-- fs/xfs/xfs_attr_item.c | 4 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.c | 1 + fs/xfs/xfs_trace.h | 36 ++- fs/xfs/xfs_trans_ail.c | 26 +- include/acpi/acpixf.h | 142 +++++----- include/linux/dma-mapping.h | 4 +- include/linux/netdevice.h | 2 - include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/rtnetlink.h | 9 +- include/linux/swapops.h | 20 +- include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/net/inet_hashtables.h | 14 + include/net/netfilter/nf_conntrack_expect.h | 44 ++- include/net/netlink.h | 21 +- include/net/rtnetlink.h | 5 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + kernel/bpf/btf.c | 24 +- kernel/bpf/verifier.c | 10 +- kernel/dma/swiotlb.c | 21 +- kernel/futex/pi.c | 3 +- kernel/module/main.c | 7 + kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_osnoise.c | 8 +- lib/nlattr.c | 6 + mm/damon/sysfs.c | 3 + net/atm/lec.c | 72 +++-- net/atm/lec.h | 2 +- net/bluetooth/eir.c | 7 +- net/bluetooth/eir.h | 2 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sync.c | 5 +- net/bluetooth/l2cap_core.c | 28 +- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 40 ++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/proc.c | 3 +- net/core/dev.c | 70 +++-- net/core/dev.h | 7 + net/core/rtnetlink.c | 51 ++-- net/hsr/hsr_device.c | 32 ++- net/ipv4/esp4.c | 11 +- net/ipv4/inet_connection_sock.c | 72 +++-- net/ipv4/inet_hashtables.c | 3 +- net/ipv4/ip_gre.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/esp6.c | 11 +- net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/xfrm6_output.c | 4 +- net/key/af_key.c | 19 +- net/mptcp/pm_netlink.c | 2 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 29 +- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 103 +++---- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 18 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++----- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 10 +- net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-geneve.c | 2 +- net/openvswitch/vport-gre.c | 2 +- net/openvswitch/vport-netdev.c | 13 +- net/openvswitch/vport-vxlan.c | 2 +- net/packet/af_packet.c | 1 + net/qrtr/af_qrtr.c | 31 +- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_state.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/pci/hda/patch_realtek.c | 2 + sound/soc/cirrus/ep93xx-i2s.c | 40 ++- sound/soc/codecs/adau1372.c | 34 ++- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/usb/caiaq/device.c | 2 +- tools/objtool/check.c | 5 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 + 286 files changed, 3071 insertions(+), 1445 deletions(-)

1 month

11
11
0 0

[PATCH 6.19 000/311] 6.19.12-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.12 release. There are 311 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 11 Apr 2026 09:16:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.12-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.12-rc2 Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Petr Mladek <pmladek(a)suse.com> kallsyms: prevent module removal when printing module name and buildid Petr Mladek <pmladek(a)suse.com> kallsyms: cleanup code for appending the module buildid Petr Mladek <pmladek(a)suse.com> kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() Petr Mladek <pmladek(a)suse.com> kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Aditya Garg <gargaditya08(a)live.com> HID: appletb-kbd: add .resume method in PM Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: thunderbolt: Set enter_vdo during initialization Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Address thermal zone removal races with resume Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Andrea Righi <arighi(a)nvidia.com> sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Changwoo Min <changwoo(a)igalia.com> sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Srujana Challa <schalla(a)marvell.com> virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN Jason Gunthorpe <jgg(a)ziepe.ca> iommupt: Fix short gather if the unmap goes into a large mapping Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Nicolas Pitre <nico(a)fluxnic.net> vt: resize saved unicode buffer on alt screen exit after resize Liav Mordouch <liavmordouch(a)gmail.com> vt: discard stale unicode buffer on alt screen exit after resize Dave Penkler <dpenkler(a)gmail.com> gpib: Fix fluke driver s390 compile issue Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Changwoo Min <changwoo(a)igalia.com> PM: EM: Fix NULL pointer dereference when perf domain ID is not found Guangshuo Li <lgs201920130244(a)gmail.com> reset: gpio: fix double free in reset_add_gpio_aux_device() error path Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix memory leak with CCA cards used as accelerator Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Edward Adam Davis <eadavis(a)qq.com> comedi: runflags cannot determine whether to reclaim chanlist Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Guangshuo Li <lgs201920130244(a)gmail.com> auxdisplay: line-display: fix NULL dereference in linedisp_release Jens Axboe <axboe(a)kernel.dk> io_uring: protect remaining lockless ctx->rings accesses with RCU Guan-Yu Lin <guanyulin(a)google.com> usb: core: use dedicated spinlock for offload state Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Guan-Yu Lin <guanyulin(a)google.com> usb: host: xhci-sideband: delegate offload_usage tracking to class drivers Felix Gu <ustc.gu(a)gmail.com> usb: misc: usbio: Fix URB memory leak on submit failure Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Johan Hovold <johan(a)kernel.org> gpib: lpvo_usb: fix memory leak on disconnect Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: reduce the scope on unexpected reset Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() Aldo Conte <aldocontelk(a)gmail.com> iio: light: veml6070: fix veml6070_read() return value David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: imu: adis16550: fix swapped gyro/accel filter functions Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl313: add missing error check in predisable Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ade9000: move mutex init before IRQ registration Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong return type in streaming push Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: normalize return value of gpio_get Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: validate doorbell_offset in user queue creation Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix wait after reset sequence in S4 Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: fix quaternion alignment David Lechner <dlechner(a)baylibre.com> iio: add IIO_DECLARE_QUATERNION() macro Adam Crosser <adam.crosser(a)praetorian.com> gpib: fix use-after-free in IO ioctl handlers Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests Oleh Konko <security(a)1seal.org> Bluetooth: hci_event: move wake reason storage into validated event handlers hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: change quirk for HP OmniBook 7 Laptop 16-bh0xxx Sourav Nayak <nonameblank007(a)gmail.com> ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for Acer Swift SFG14-73 Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Check the error for index mapping Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Tejun Heo <tj(a)kernel.org> sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Cheng-Yang Chou <yphbchou0911(a)gmail.com> sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Alice Ryhl <aliceryhl(a)google.com> rust_binder: use AssertSync for BINDER_VM_OPS Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Sunil V L <sunilvl(a)oss.qualcomm.com> ACPI: RIMT: Add dependency between iommu and devices Zishun Yi <vulab(a)iscas.ac.cn> riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Ian Rogers <irogers(a)google.com> perf/x86: Fix potential bad container_of in intel_pmu_hw_config Peter Zijlstra <peterz(a)infradead.org> sched/debug: Fix avg_vruntime() usage Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Corey Hickey <bugfood-c(a)fatooh.org> hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI Chen Ni <nichen(a)iscas.ac.cn> drm/sysfb: Fix efidrm error handling and memory type mismatch Jessica Liu <liu.xuemei1(a)zte.com.cn> irqchip/riscv-aplic: Restrict genpd notifier to device tree only Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Felix Gu <ustc.gu(a)gmail.com> spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clear restart flag in pxp_start after jumping back Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Remove incorrect handling of impossible state during suspend Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clean up termination status on failure Jonathan Cavitt <jonathan.cavitt(a)intel.com> drm/xe/xe_pagefault: Disallow writes to read-only VMAs Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix reset control leak on probe error Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix resource leak in remove() callback Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: shorten the critical section in gpiochip_setup_shared() Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix array access with zero-length block read Qi Tang <tpluszz77(a)gmail.com> io_uring/rsrc: reject zero-length fixed buffer import Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away Liu Ying <victor.liu(a)nxp.com> drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show() Felix Gu <ustc.gu(a)gmail.com> gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: handle pins shared by child nodes of devices Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: call gpio_chip::of_xlate() if set Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() Barnabás Pőcze <pobrn(a)protonmail.com> gpiolib: clear requested flag if line is invalid David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Refactor some basic ring setup and adjustment logic Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_h4: Fix race during initialization Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Fix UAF in le_read_features_complete Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Add support for setting BT_PHY Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP Michal Piekos <michal.piekos(a)mmpsystems.pl> net: stmmac: skip VLAN restore when VLAN hash ops are missing Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Geliang Tang <geliang(a)kernel.org> mptcp: add eat_recv_skb helper Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Xiang Mei <xmei5(a)asu.edu> bridge: mrp: reject zero test interval to avoid OOM panic Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Revert to operating out-of-place Pengpeng Hou <pengpeng(a)iscas.ac.cn> bnxt_en: set backing store type from query type Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Dag Smedberg <dag(a)dsmedberg.se> ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP Wei Fang <wei.fang(a)nxp.com> net: enetc: do not allow VF to configure the RSS key Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() David Carlier <devnexen(a)gmail.com> net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sherry Yang <sherry.yang(a)oracle.com> iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Wei Fang <wei.fang(a)nxp.com> net: enetc: do not access non-existent registers on pseudo MAC Wei Fang <wei.fang(a)nxp.com> net: enetc: add graceful stop to safely reinitialize the TX Ring Wei Fang <wei.fang(a)nxp.com> net: enetc: reset PIR and CIR if they are not equal when initializing TX ring Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Qingfang Deng <dqfext(a)gmail.com> netdevsim: fix build if SKB_EXTENSIONS=n Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Fix RX skb truesize accounting Sabrina Dubroca <sd(a)queasysnail.net> mpls: add seqcount to protect the platform_label{,s} pair Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Mikulas Patocka <mpatocka(a)redhat.com> crypto: deflate - fix spurious -ENOSPC Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Tejun Heo <tj(a)kernel.org> cgroup: Fix cgroup_drain_dying() testing the wrong condition Tejun Heo <tj(a)kernel.org> selftests/cgroup: Don't require synchronous populated update on task exit Tejun Heo <tj(a)kernel.org> cgroup: Wait for dying tasks to leave on rmdir Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: mld: correctly set wifi generation data Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't send a 6E related command when not supported Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mld: Fix MLO scan timing Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix error handling in mshv_region_pin Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR Paulo Alcantara <pc(a)manguebit.org> smb: client: fix generic/694 due to wrong ->i_blocks Alex Hung <alex.hung(a)amd.com> drm/amd/display: Fix gamma 2.2 colorop TFs ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Joe Lawrence <joe.lawrence(a)redhat.com> objtool/klp: fix mkstemp() failure with long paths Lee Jones <lee(a)kernel.org> HID: core: Mitigate potential OOB by removing bogus memset() Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 Long Li <leo.lilong(a)huawei.com> xfs: close crash window in attr dabtree inactivation Long Li <leo.lilong(a)huawei.com> xfs: factor out xfs_attr3_leaf_init Long Li <leo.lilong(a)huawei.com> xfs: factor out xfs_attr3_node_entry_remove Long Li <leo.lilong(a)huawei.com> xfs: only assert new size for datafork during truncate extents Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> scsi: target: file: Use kzalloc_flex for aio_cmd Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/riscv/kernel/process.c | 4 +- arch/s390/kernel/perf_cpum_sf.c | 6 +- arch/x86/events/intel/core.c | 6 +- arch/x86/kernel/Makefile | 14 ++ arch/x86/mm/Makefile | 2 + crypto/af_alg.c | 53 ++---- crypto/algif_aead.c | 100 ++--------- crypto/algif_skcipher.c | 6 +- crypto/authencesn.c | 50 +++--- crypto/deflate.c | 11 +- drivers/accel/qaic/qaic_control.c | 47 ++++- drivers/acpi/riscv/rimt.c | 7 + drivers/android/binder/page_range.rs | 8 +- drivers/android/binder/rust_binder_main.rs | 2 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/hci_h4.c | 3 - drivers/comedi/comedi_fops.c | 8 +- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 ++ drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 ++-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 +++---- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++-- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpib/Kconfig | 1 + drivers/gpib/common/gpib_os.c | 96 +++++++--- drivers/gpib/include/gpib_types.h | 8 + drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpio/gpio-qixis-fpga.c | 4 +- drivers/gpio/gpiolib-shared.c | 57 ++++-- drivers/gpio/gpiolib-shared.h | 11 +- drivers/gpio/gpiolib.c | 135 +++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_colorop.c | 6 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 17 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_bridge.c | 16 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/i915/display/intel_cdclk.c | 54 ++++++ drivers/gpu/drm/sysfb/efidrm.c | 46 +++-- drivers/gpu/drm/xe/xe_pagefault.c | 6 + drivers/gpu/drm/xe/xe_pxp.c | 11 +- drivers/hid/hid-appletb-kbd.c | 5 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 ++ drivers/hv/mshv_regions.c | 6 +- drivers/hwmon/asus-ec-sensors.c | 7 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 10 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl313_core.c | 2 + drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ade9000.c | 12 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 +++-- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/adc/ti-ads7950.c | 8 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++-- drivers/iio/imu/adis16550.c | 8 +- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 15 +- drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/light/veml6070.c | 4 +- drivers/iio/orientation/hid-sensor-rotation.c | 24 ++- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/interconnect/qcom/sm8450.c | 4 +- drivers/iommu/generic_pt/fmt/amdv1.h | 2 +- drivers/iommu/generic_pt/iommu_pt.h | 2 +- drivers/irqchip/irq-riscv-aplic-main.c | 4 +- drivers/misc/fastrpc.c | 5 +- drivers/misc/mei/hw-me.c | 14 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/ethernet/airoha/airoha_eth.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 76 +++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 13 +- drivers/net/ethernet/freescale/enetc/enetc4_hw.h | 11 ++ drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 118 +++++++++++-- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/ti/icssg/icssg_common.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +- drivers/net/phy/sfp.c | 7 +- drivers/net/virtio_net.c | 20 +-- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- .../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 + drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 10 ++ drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++---- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +- drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/reset/core.c | 1 - drivers/s390/crypto/zcrypt_msgtype6.c | 32 ++-- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++ drivers/spi/spi-cadence-quadspi.c | 17 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/spi/spi-stm32-ospi.c | 9 +- drivers/target/loopback/tcm_loop.c | 52 +++++- drivers/target/target_core_file.c | 2 +- drivers/thermal/thermal_core.c | 32 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/vt/vt.c | 18 ++ drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/driver.c | 23 ++- drivers/usb/core/offload.c | 102 ++++++----- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/core/usb.c | 1 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++-- drivers/usb/gadget/function/f_eem.c | 59 ++++--- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++++-- drivers/usb/gadget/function/f_subset.c | 63 ++++--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++-- drivers/usb/gadget/function/f_uvc.c | 39 +++- drivers/usb/gadget/function/u_ecm.h | 21 ++- drivers/usb/gadget/function/u_eem.h | 21 ++- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 ++- drivers/usb/gadget/function/u_rndis.h | 31 +++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci-sideband.c | 18 +- drivers/usb/misc/usbio.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/altmodes/thunderbolt.c | 44 ++--- drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/smb/client/cifsglob.h | 6 + fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 +-- fs/smb/client/smb2ops.c | 20 +-- fs/smb/server/smb2pdu.c | 121 +++++++++---- fs/smb/server/smbacl.c | 43 +++++ fs/smb/server/smbacl.h | 2 + fs/xfs/libxfs/xfs_attr_leaf.c | 22 +++ fs/xfs/libxfs/xfs_attr_leaf.h | 3 + fs/xfs/libxfs/xfs_da_btree.c | 53 ++++-- fs/xfs/libxfs/xfs_da_btree.h | 2 + fs/xfs/xfs_attr_inactive.c | 99 ++++++----- fs/xfs/xfs_inode.c | 3 +- include/crypto/if_alg.h | 5 +- include/linux/cgroup-defs.h | 3 + include/linux/iio/iio.h | 12 ++ include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/skbuff.h | 1 + include/linux/usb.h | 10 +- include/net/bluetooth/bluetooth.h | 39 ++-- include/net/bluetooth/hci.h | 9 + include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/hci_sync.h | 3 + include/net/netfilter/nf_conntrack_expect.h | 20 ++- include/net/netns/mpls.h | 1 + io_uring/io_uring.c | 62 ++++--- io_uring/io_uring.h | 34 +++- io_uring/net.c | 4 + io_uring/rsrc.c | 4 + kernel/bpf/verifier.c | 37 +++- kernel/cgroup/cgroup.c | 88 ++++++++- kernel/kallsyms.c | 64 +++++-- kernel/power/em_netlink.c | 2 + kernel/sched/debug.c | 4 +- kernel/sched/ext.c | 144 +++++++++++---- kernel/sched/ext_idle.c | 33 ++-- kernel/sched/fair.c | 10 +- kernel/sched/sched.h | 3 + kernel/trace/bpf_trace.c | 4 + lib/crypto/chacha-block-generic.c | 4 + net/atm/lec.c | 72 +++++--- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 113 +++++++++++- net/bluetooth/hci_event.c | 153 ++++++++-------- net/bluetooth/hci_sync.c | 152 +++++++++++++--- net/bluetooth/l2cap_sock.c | 20 ++- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 +++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/bridge/br_mrp_netlink.c | 4 +- net/core/dev.c | 38 +++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 ++-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 ++ net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mpls/af_mpls.c | 29 ++- net/mptcp/protocol.c | 30 ++-- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 ++- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++------ net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++------- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 +++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 ++-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/hda/codecs/realtek/alc269.c | 12 +- sound/pci/ctxfi/ctatc.c | 10 +- sound/pci/ctxfi/ctdaio.c | 82 +++++---- sound/soc/cirrus/ep93xx-i2s.c | 34 ++-- sound/soc/intel/boards/Kconfig | 2 - sound/usb/caiaq/device.c | 2 +- sound/usb/qcom/qc_audio_offload.c | 10 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 5 +- tools/objtool/elf.c | 23 +-- tools/testing/selftests/cgroup/lib/cgroup_util.c | 15 ++ .../selftests/cgroup/lib/include/cgroup_util.h | 2 + tools/testing/selftests/cgroup/test_core.c | 3 +- tools/testing/selftests/cgroup/test_kill.c | 7 +- 311 files changed, 3910 insertions(+), 1760 deletions(-)

1 month, 1 week

11
10
0 0

[PATCH 6.6 000/160] 6.6.134-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.134 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.134-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.134-rc1 Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Theodore Ts'o <tytso(a)mit.edu> ext4: handle wraparound when searching for blocks for indirect mapped blocks Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Joy Zou <joy.zou(a)nxp.com> dmaengine: fsl-edma: fix channel parameter config for fixed channel requests Joy Zou <joy.zou(a)nxp.com> dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() Nikunj A Dadhania <nikunj(a)amd.com> x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Jean-Baptiste Maneyrol <jean-baptiste.maneyrol(a)tdk.com> iio: imu: inv_icm42600: fix odr switch when turning buffer off Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Xi Ruoyao <xry111(a)xry111.site> LoongArch: vDSO: Emit GNU_EH_FRAME correctly Andrew Price <anprice(a)redhat.com> gfs2: Validate i_depth for exhash directories Andrew Price <anprice(a)redhat.com> gfs2: Improve gfs2_consist_inode() usage Filipe Manana <fdmanana(a)suse.com> btrfs: do not free data reservation in fallback from inline due to -ENOSPC Qu Wenruo <wqu(a)suse.com> btrfs: fix the qgroup data free range for inline data extents Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Miaohe Lin <linmiaohe(a)huawei.com> fork: defer linking file vma until vma is fully initialized Alex Williamson <alex.williamson(a)redhat.com> vfio/pci: Insert full vma on mmap'd MMIO fault Alex Williamson <alex.williamson(a)redhat.com> vfio/pci: Use unmap_mapping_range() Alex Williamson <alex.williamson(a)redhat.com> vfio: Create vfio_fs_type with inode per device Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session P Praneesh <quic_ppranees(a)quicinc.com> wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation Venkateswara Naralasetty <quic_vnaralas(a)quicinc.com> wifi: ath11k: skip status ring entry processing Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/patch-scs.c | 8 + arch/loongarch/include/asm/linkage.h | 36 +++ arch/loongarch/include/asm/sigframe.h | 9 + arch/loongarch/kernel/asm-offsets.c | 2 + arch/loongarch/kernel/signal.c | 6 +- arch/loongarch/vdso/Makefile | 4 +- arch/loongarch/vdso/sigreturn.S | 6 +- arch/mips/lib/multi3.c | 6 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/x86/kernel/cpu/common.c | 18 +- crypto/af_alg.c | 4 +- drivers/accel/qaic/qaic_control.c | 47 +++- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 ++--- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/dma/fsl-edma-main.c | 31 +-- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 + drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/adc/ti-adc161s626.c | 41 ++- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/input/joystick/xpad.c | 5 + drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 1 + drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_main.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 6 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/phy/sfp.c | 7 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp.h | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 210 ++++++++++------ drivers/net/wireless/ath/ath11k/hal.c | 16 +- drivers/net/wireless/ath/ath11k/hal.h | 2 + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/spi/spi-geni-qcom.c | 9 +- drivers/target/loopback/tcm_loop.c | 52 +++- drivers/thermal/thermal_core.c | 1 + drivers/thunderbolt/nhi.c | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_rndis.c | 9 +- drivers/usb/gadget/function/f_subset.c | 6 + drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++- drivers/usb/gadget/function/f_uvc.c | 39 ++- drivers/usb/gadget/function/u_ether.c | 10 +- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 ++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/vfio/device_cdev.c | 7 + drivers/vfio/group.c | 7 + drivers/vfio/pci/vfio_pci_core.c | 277 +++++---------------- drivers/vfio/vfio_main.c | 44 ++++ fs/btrfs/inode.c | 6 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/ext4/fast_commit.c | 4 +- fs/ext4/inode.c | 15 +- fs/ext4/mballoc.c | 2 + fs/gfs2/dir.c | 37 +-- fs/gfs2/glops.c | 40 +-- fs/gfs2/xattr.c | 28 ++- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/swapops.h | 20 +- include/linux/vfio.h | 1 + include/linux/vfio_pci_core.h | 2 - include/net/netfilter/nf_conntrack_expect.h | 20 +- kernel/bpf/verifier.c | 10 +- kernel/fork.c | 29 +-- net/atm/lec.c | 72 ++++-- net/atm/lec.h | 2 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sync.c | 11 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 ++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 22 +- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 +-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mptcp/pm_netlink.c | 2 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 +- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++---- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++----- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 +-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++- sound/usb/caiaq/device.c | 2 +- tools/objtool/check.c | 5 +- 165 files changed, 1668 insertions(+), 947 deletions(-)

1 month, 1 week

11
10
0 0

[PATCH 6.12 000/241] 6.12.81-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.81 release. There are 241 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 11 Apr 2026 09:16:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.81-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.81-rc2 Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary Eduard Zingerman <eddyz87(a)gmail.com> bpf: Fix u32/s32 bounds when ranges cross min/max boundary Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Add third round of bounds deduction Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test invariants on JSLT crossing sign Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test cross-sign 64bits range refinement Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Improve bounds when s64 crosses sign boundary Charlene Liu <Charlene.Liu(a)amd.com> drm/amd/display: Correct logic check error for fastboot Timur Kristóf <timur.kristof(a)gmail.com> drm/amd: Disable ASPM on SI Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Disable scaling on DCE6 for now Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Reject modes with too high pixel clock on DCE6-10 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Disable fastboot on DCE 6 too Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM in some situations Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: decouple ASPM with pcie dpm Mario Limonciello <mario.limonciello(a)amd.com> x86/CPU/AMD: Add additional fixed RDSEED microcode revisions Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Heiko Carstens <hca(a)linux.ibm.com> s390/perf_cpum_sf: Convert to use try_cmpxchg128() Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 David Hildenbrand (Arm) <david(a)kernel.org> mm/memory: fix PMD/PUD checks in follow_pfnmap_start() Anshuman Khandual <anshuman.khandual(a)arm.com> mm: replace READ_ONCE() with standard page table accessors Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Nikunj A Dadhania <nikunj(a)amd.com> x86/fred: Fix early boot failures on SEV-ES/SNP guests Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Filipe Manana <fdmanana(a)suse.com> btrfs: do not free data reservation in fallback from inline due to -ENOSPC Qu Wenruo <wqu(a)suse.com> btrfs: fix the qgroup data free range for inline data extents Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Sasha Levin <sashal(a)kernel.org> Revert "LoongArch/orc: Use RCU in all users of __module_address()." Sasha Levin <sashal(a)kernel.org> Revert "LoongArch: Remove unnecessary checks for ORC unwinder" Sasha Levin <sashal(a)kernel.org> Revert "LoongArch: Handle percpu handler address for ORC unwinder" Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Vincent Guittot <vincent.guittot(a)linaro.org> sched/fair: Use protect_slice() instead of direct comparison Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: propagate BUF_MORE through early buffer commit path Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF Joanne Koong <joannelkoong(a)gmail.com> io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields Caleb Sander Mateos <csander(a)purestorage.com> io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: enable bundles for incrementally consumed buffers Jens Axboe <axboe(a)kernel.dk> io_uring/rw: check for NULL io_br_sel when putting a buffer Jens Axboe <axboe(a)kernel.dk> io_uring/net: correct type for min_not_zero() cast Jens Axboe <axboe(a)kernel.dk> io_uring: remove async/poll related provided buffer recycles Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: switch to storing struct io_buffer_list locally Jens Axboe <axboe(a)kernel.dk> io_uring/net: use struct io_br_sel->val as the send finish value Jens Axboe <axboe(a)kernel.dk> io_uring/net: use struct io_br_sel->val as the recv finish value Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: use struct io_br_sel for multiple buffers picking Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: introduce struct io_br_sel Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers Jens Axboe <axboe(a)kernel.dk> io_uring/net: clarify io_recv_buf_select() return value Jens Axboe <axboe(a)kernel.dk> io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: uninline __io_put_kbufs Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: introduce io_kbuf_drop_legacy() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: open code __io_put_kbuf() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf caching Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: simplify __io_put_kbuf Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf kmem cache Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf bulk allocation ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/loongarch/include/asm/setup.h | 3 - arch/loongarch/kernel/unwind_orc.c | 32 +-- arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/kernel/perf_cpum_sf.c | 30 +-- arch/x86/coco/sev/core.c | 6 + arch/x86/entry/entry_fred.c | 14 + arch/x86/kernel/cpu/amd.c | 7 + crypto/af_alg.c | 4 +- drivers/accel/qaic/qaic_control.c | 47 +++- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 ++--- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 39 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 20 +- .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c | 5 + .../gpu/drm/amd/display/dc/dce60/dce60_resource.c | 59 +++-- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 +- .../display/dc/resource/dce100/dce100_resource.c | 10 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 10 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 ++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 ++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 + drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 ++- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 + drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 4 + drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/mediatek/airoha_eth.c | 18 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 6 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/phy/sfp.c | 7 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/spi/spi-cadence-quadspi.c | 13 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/target/loopback/tcm_loop.c | 52 +++- drivers/thermal/thermal_core.c | 1 + drivers/thunderbolt/nhi.c | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++- drivers/usb/gadget/function/f_eem.c | 59 +++-- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++-- drivers/usb/gadget/function/f_subset.c | 63 +++-- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++- drivers/usb/gadget/function/f_uvc.c | 39 ++- drivers/usb/gadget/function/u_ecm.h | 21 +- drivers/usb/gadget/function/u_eem.h | 21 +- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 +- drivers/usb/gadget/function/u_rndis.h | 31 ++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/inode.c | 6 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/ext4/fast_commit.c | 4 +- fs/ext4/inode.c | 15 +- fs/smb/server/smb2pdu.c | 121 ++++++--- fs/smb/server/smbacl.c | 43 +++ fs/smb/server/smbacl.h | 2 + include/linux/io_uring_types.h | 9 - include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/swapops.h | 27 +- include/net/netfilter/nf_conntrack_expect.h | 20 +- io_uring/io_uring.c | 15 +- io_uring/io_uring.h | 1 - io_uring/kbuf.c | 289 ++++++++++----------- io_uring/kbuf.h | 148 +++-------- io_uring/net.c | 149 ++++++----- io_uring/poll.c | 4 - io_uring/rw.c | 58 +++-- kernel/bpf/verifier.c | 87 ++++++- kernel/sched/fair.c | 12 +- mm/gup.c | 10 +- mm/hmm.c | 2 +- mm/memory.c | 22 +- mm/mprotect.c | 2 +- mm/sparse-vmemmap.c | 2 +- mm/vmscan.c | 2 +- net/atm/lec.c | 72 +++-- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 ++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 38 ++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 +-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 +- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++---- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 +++++++++----- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 +-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++- sound/soc/intel/boards/Kconfig | 2 - sound/usb/caiaq/device.c | 2 +- tools/objtool/check.c | 5 +- .../testing/selftests/bpf/prog_tests/reg_bounds.c | 62 ++++- .../testing/selftests/bpf/progs/verifier_bounds.c | 159 +++++++++++- 218 files changed, 2626 insertions(+), 1283 deletions(-)

1 month, 1 week

8
7
0 0

[PATCH 6.18 000/276] 6.18.22-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.22 release. There are 276 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 11 Apr 2026 09:26:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.22-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.22-rc2 Andrea Righi <arighi(a)nvidia.com> sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Tejun Heo <tj(a)kernel.org> sched_ext: Refactor do_enqueue_task() local and global DSQ paths David Hildenbrand (Arm) <david(a)kernel.org> mm/memory: fix PMD/PUD checks in follow_pfnmap_start() Anshuman Khandual <anshuman.khandual(a)arm.com> mm: replace READ_ONCE() with standard page table accessors Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> scsi: target: file: Use kzalloc_flex for aio_cmd Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: Fix DCE LVDS handling Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Petr Mladek <pmladek(a)suse.com> kallsyms: prevent module removal when printing module name and buildid Petr Mladek <pmladek(a)suse.com> kallsyms: cleanup code for appending the module buildid Petr Mladek <pmladek(a)suse.com> kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() Petr Mladek <pmladek(a)suse.com> kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Aditya Garg <gargaditya08(a)live.com> HID: appletb-kbd: add .resume method in PM Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: thunderbolt: Set enter_vdo during initialization Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Address thermal zone removal races with resume Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Changwoo Min <changwoo(a)igalia.com> sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Srujana Challa <schalla(a)marvell.com> virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Nicolas Pitre <nico(a)fluxnic.net> vt: resize saved unicode buffer on alt screen exit after resize Liav Mordouch <liavmordouch(a)gmail.com> vt: discard stale unicode buffer on alt screen exit after resize Dave Penkler <dpenkler(a)gmail.com> gpib: Fix fluke driver s390 compile issue Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix memory leak with CCA cards used as accelerator Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: sc7280: make use of common helpers Jens Axboe <axboe(a)kernel.dk> io_uring: protect remaining lockless ctx->rings accesses with RCU Guan-Yu Lin <guanyulin(a)google.com> usb: core: use dedicated spinlock for offload state Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Guan-Yu Lin <guanyulin(a)google.com> usb: host: xhci-sideband: delegate offload_usage tracking to class drivers Felix Gu <ustc.gu(a)gmail.com> usb: misc: usbio: Fix URB memory leak on submit failure Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Johan Hovold <johan(a)kernel.org> gpib: lpvo_usb: fix memory leak on disconnect Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: reduce the scope on unexpected reset Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() Aldo Conte <aldocontelk(a)gmail.com> iio: light: veml6070: fix veml6070_read() return value David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: imu: adis16550: fix swapped gyro/accel filter functions Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl313: add missing error check in predisable Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ade9000: move mutex init before IRQ registration Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong return type in streaming push Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: normalize return value of gpio_get Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: validate doorbell_offset in user queue creation Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix wait after reset sequence in S4 Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: fix quaternion alignment David Lechner <dlechner(a)baylibre.com> iio: add IIO_DECLARE_QUATERNION() macro Adam Crosser <adam.crosser(a)praetorian.com> gpib: fix use-after-free in IO ioctl handlers Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Sourav Nayak <nonameblank007(a)gmail.com> ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Cheng-Yang Chou <yphbchou0911(a)gmail.com> sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Alice Ryhl <aliceryhl(a)google.com> rust_binder: use AssertSync for BINDER_VM_OPS Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Sunil V L <sunilvl(a)oss.qualcomm.com> ACPI: RIMT: Add dependency between iommu and devices Zishun Yi <vulab(a)iscas.ac.cn> riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Ian Rogers <irogers(a)google.com> perf/x86: Fix potential bad container_of in intel_pmu_hw_config Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Corey Hickey <bugfood-c(a)fatooh.org> hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI Chen Ni <nichen(a)iscas.ac.cn> drm/sysfb: Fix efidrm error handling and memory type mismatch Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Felix Gu <ustc.gu(a)gmail.com> spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clear restart flag in pxp_start after jumping back Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Remove incorrect handling of impossible state during suspend Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clean up termination status on failure Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix reset control leak on probe error Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix resource leak in remove() callback Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix array access with zero-length block read Qi Tang <tpluszz77(a)gmail.com> io_uring/rsrc: reject zero-length fixed buffer import Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away Barnabás Pőcze <pobrn(a)protonmail.com> gpiolib: clear requested flag if line is invalid Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio() David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_h4: Fix race during initialization Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP Michal Piekos <michal.piekos(a)mmpsystems.pl> net: stmmac: skip VLAN restore when VLAN hash ops are missing Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Geliang Tang <geliang(a)kernel.org> mptcp: add eat_recv_skb helper Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Revert to operating out-of-place Pengpeng Hou <pengpeng(a)iscas.ac.cn> bnxt_en: set backing store type from query type Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Dag Smedberg <dag(a)dsmedberg.se> ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP Wei Fang <wei.fang(a)nxp.com> net: enetc: do not allow VF to configure the RSS key Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Wei Fang <wei.fang(a)nxp.com> net: enetc: reset PIR and CIR if they are not equal when initializing TX ring Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Qingfang Deng <dqfext(a)gmail.com> netdevsim: fix build if SKB_EXTENSIONS=n Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Fix RX skb truesize accounting Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Mikulas Patocka <mpatocka(a)redhat.com> crypto: deflate - fix spurious -ENOSPC Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: mld: correctly set wifi generation data Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: disable EHT if the device doesn't allow it Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: cfg: add new device names Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't send a 6E related command when not supported Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mld: Fix MLO scan timing Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: fix remaining kernel-doc warnings Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR Paulo Alcantara <pc(a)manguebit.org> smb: client: fix generic/694 due to wrong ->i_blocks ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Lee Jones <lee(a)kernel.org> HID: core: Mitigate potential OOB by removing bogus memset() Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/riscv/kernel/process.c | 4 +- arch/s390/kernel/perf_cpum_sf.c | 6 +- arch/x86/events/intel/core.c | 6 +- arch/x86/kernel/Makefile | 14 ++ arch/x86/mm/Makefile | 2 + crypto/af_alg.c | 53 ++---- crypto/algif_aead.c | 100 ++--------- crypto/algif_skcipher.c | 6 +- crypto/authencesn.c | 50 +++--- crypto/deflate.c | 11 +- drivers/accel/qaic/qaic_control.c | 47 ++++- drivers/acpi/riscv/rimt.c | 7 + drivers/android/binder/page_range.rs | 8 +- drivers/android/binder/rust_binder_main.rs | 2 +- drivers/bluetooth/hci_h4.c | 3 - drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 ++ drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 ++-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 +++---- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++-- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpio/gpio-aspeed.c | 6 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpio/gpiolib-cdev.c | 12 +- drivers/gpio/gpiolib-sysfs.c | 14 +- drivers/gpio/gpiolib.c | 175 +++++++++--------- drivers/gpio/gpiolib.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 17 +- .../display/dc/resource/dce100/dce100_resource.c | 5 +- .../display/dc/resource/dce110/dce110_resource.c | 5 +- .../display/dc/resource/dce112/dce112_resource.c | 5 +- .../display/dc/resource/dce120/dce120_resource.c | 5 +- .../amd/display/dc/resource/dce60/dce60_resource.c | 13 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/sysfb/efidrm.c | 46 +++-- drivers/gpu/drm/xe/xe_pxp.c | 11 +- drivers/hid/hid-appletb-kbd.c | 5 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 ++ drivers/hwmon/asus-ec-sensors.c | 7 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 10 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl313_core.c | 2 + drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ade9000.c | 12 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 +++-- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/adc/ti-ads7950.c | 8 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++-- drivers/iio/imu/adis16550.c | 8 +- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/light/veml6070.c | 4 +- drivers/iio/orientation/hid-sensor-rotation.c | 24 ++- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 5 +- drivers/misc/mei/hw-me.c | 14 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/ethernet/airoha/airoha_eth.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 13 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +- drivers/net/phy/sfp.c | 7 +- drivers/net/virtio_net.c | 20 +-- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 1 + drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 24 +++ drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 1 + drivers/net/wireless/intel/iwlwifi/fw/api/cmdhdr.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/api/coex.h | 4 +- .../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 + .../net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 14 +- drivers/net/wireless/intel/iwlwifi/fw/api/debug.h | 2 +- .../net/wireless/intel/iwlwifi/fw/api/location.h | 8 +- drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 5 +- drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 88 +++++---- drivers/net/wireless/intel/iwlwifi/fw/api/sta.h | 6 +- drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 39 ++-- drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 2 +- drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/file.h | 74 ++++++-- drivers/net/wireless/intel/iwlwifi/fw/img.h | 12 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 22 ++- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 8 +- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 +- drivers/net/wireless/intel/iwlwifi/iwl-modparams.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 17 +- drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h | 1 + drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 6 +- drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++---- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +- drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 5 + drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/s390/crypto/zcrypt_msgtype6.c | 32 ++-- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++ drivers/spi/spi-cadence-quadspi.c | 17 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/spi/spi-stm32-ospi.c | 9 +- drivers/staging/gpib/Kconfig | 1 + drivers/staging/gpib/common/gpib_os.c | 96 +++++++--- drivers/staging/gpib/include/gpib_types.h | 8 + drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 +- drivers/target/loopback/tcm_loop.c | 52 +++++- drivers/target/target_core_file.c | 2 +- drivers/thermal/thermal_core.c | 32 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/vt/vt.c | 18 ++ drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/driver.c | 23 ++- drivers/usb/core/offload.c | 102 ++++++----- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/core/usb.c | 1 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++-- drivers/usb/gadget/function/f_eem.c | 59 ++++--- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++++-- drivers/usb/gadget/function/f_subset.c | 63 ++++--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++-- drivers/usb/gadget/function/f_uvc.c | 39 +++- drivers/usb/gadget/function/u_ecm.h | 21 ++- drivers/usb/gadget/function/u_eem.h | 21 ++- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 ++- drivers/usb/gadget/function/u_rndis.h | 31 +++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci-sideband.c | 18 +- drivers/usb/misc/usbio.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/altmodes/thunderbolt.c | 44 ++--- drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/smb/client/cifsglob.h | 6 + fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 +-- fs/smb/client/smb2ops.c | 20 +-- fs/smb/server/smb2pdu.c | 121 +++++++++---- fs/smb/server/smbacl.c | 43 +++++ fs/smb/server/smbacl.h | 2 + include/crypto/if_alg.h | 5 +- include/linux/iio/iio.h | 12 ++ include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/skbuff.h | 1 + include/linux/usb.h | 10 +- include/net/netfilter/nf_conntrack_expect.h | 20 ++- io_uring/io_uring.c | 62 ++++--- io_uring/io_uring.h | 34 +++- io_uring/net.c | 4 + io_uring/rsrc.c | 4 + kernel/bpf/verifier.c | 10 +- kernel/kallsyms.c | 64 +++++-- kernel/sched/ext.c | 70 +++++--- kernel/sched/ext_idle.c | 33 ++-- kernel/sched/fair.c | 10 +- kernel/trace/bpf_trace.c | 4 + lib/crypto/chacha-block-generic.c | 4 + mm/gup.c | 10 +- mm/hmm.c | 2 +- mm/memory.c | 22 ++- mm/mprotect.c | 2 +- mm/sparse-vmemmap.c | 2 +- mm/vmscan.c | 2 +- net/atm/lec.c | 72 +++++--- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 33 ++-- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 +++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 38 +++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 ++-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 ++ net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mptcp/protocol.c | 30 ++-- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 ++- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++------ net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++------- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 +++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 ++-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/hda/codecs/realtek/alc269.c | 2 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++-- sound/soc/intel/boards/Kconfig | 2 - sound/soc/qcom/sdw.c | 11 ++ sound/usb/caiaq/device.c | 2 +- sound/usb/qcom/qc_audio_offload.c | 10 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 5 +- 308 files changed, 3160 insertions(+), 1629 deletions(-)

1 month, 1 week

6
5
0 0

[PATCH 6.12 000/242] 6.12.81-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.81 release. There are 242 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.81-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.81-rc1 Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary Eduard Zingerman <eddyz87(a)gmail.com> bpf: Fix u32/s32 bounds when ranges cross min/max boundary Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Add third round of bounds deduction Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test invariants on JSLT crossing sign Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test cross-sign 64bits range refinement Paul Chaignon <paul.chaignon(a)gmail.com> bpf: Improve bounds when s64 crosses sign boundary Charlene Liu <Charlene.Liu(a)amd.com> drm/amd/display: Correct logic check error for fastboot Timur Kristóf <timur.kristof(a)gmail.com> drm/amd: Disable ASPM on SI Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Disable scaling on DCE6 for now Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Reject modes with too high pixel clock on DCE6-10 Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Disable fastboot on DCE 6 too Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM in some situations Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: decouple ASPM with pcie dpm Mario Limonciello <mario.limonciello(a)amd.com> x86/CPU/AMD: Add additional fixed RDSEED microcode revisions Li Xiasong <lixiasong1(a)huawei.com> MPTCP: fix lock class name family in pm_nl_create_listen_socket Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Heiko Carstens <hca(a)linux.ibm.com> s390/perf_cpum_sf: Convert to use try_cmpxchg128() Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 David Hildenbrand (Arm) <david(a)kernel.org> mm/memory: fix PMD/PUD checks in follow_pfnmap_start() Anshuman Khandual <anshuman.khandual(a)arm.com> mm: replace READ_ONCE() with standard page table accessors Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Nikunj A Dadhania <nikunj(a)amd.com> x86/fred: Fix early boot failures on SEV-ES/SNP guests Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Filipe Manana <fdmanana(a)suse.com> btrfs: do not free data reservation in fallback from inline due to -ENOSPC Qu Wenruo <wqu(a)suse.com> btrfs: fix the qgroup data free range for inline data extents Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Sasha Levin <sashal(a)kernel.org> Revert "LoongArch/orc: Use RCU in all users of __module_address()." Sasha Levin <sashal(a)kernel.org> Revert "LoongArch: Remove unnecessary checks for ORC unwinder" Sasha Levin <sashal(a)kernel.org> Revert "LoongArch: Handle percpu handler address for ORC unwinder" Dmitry Torokhov <dmitry.torokhov(a)gmail.com> x86/platform/geode: Fix on-stack property data use-after-return bug Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Vincent Guittot <vincent.guittot(a)linaro.org> sched/fair: Use protect_slice() instead of direct comparison Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: propagate BUF_MORE through early buffer commit path Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF Joanne Koong <joannelkoong(a)gmail.com> io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields Caleb Sander Mateos <csander(a)purestorage.com> io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: enable bundles for incrementally consumed buffers Jens Axboe <axboe(a)kernel.dk> io_uring/rw: check for NULL io_br_sel when putting a buffer Jens Axboe <axboe(a)kernel.dk> io_uring/net: correct type for min_not_zero() cast Jens Axboe <axboe(a)kernel.dk> io_uring: remove async/poll related provided buffer recycles Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: switch to storing struct io_buffer_list locally Jens Axboe <axboe(a)kernel.dk> io_uring/net: use struct io_br_sel->val as the send finish value Jens Axboe <axboe(a)kernel.dk> io_uring/net: use struct io_br_sel->val as the recv finish value Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: use struct io_br_sel for multiple buffers picking Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: introduce struct io_br_sel Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers Jens Axboe <axboe(a)kernel.dk> io_uring/net: clarify io_recv_buf_select() return value Jens Axboe <axboe(a)kernel.dk> io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: uninline __io_put_kbufs Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: introduce io_kbuf_drop_legacy() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: open code __io_put_kbuf() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf caching Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: simplify __io_put_kbuf Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf kmem cache Pavel Begunkov <asml.silence(a)gmail.com> io_uring/kbuf: remove legacy kbuf bulk allocation ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/loongarch/include/asm/setup.h | 3 - arch/loongarch/kernel/unwind_orc.c | 32 +-- arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/kernel/perf_cpum_sf.c | 30 +-- arch/x86/coco/sev/core.c | 6 + arch/x86/entry/entry_fred.c | 14 + arch/x86/kernel/cpu/amd.c | 7 + arch/x86/platform/geode/geode-common.c | 24 +- crypto/af_alg.c | 4 +- drivers/accel/qaic/qaic_control.c | 47 +++- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 ++--- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 39 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 20 +- .../amd/display/dc/clk_mgr/dce60/dce60_clk_mgr.c | 5 + .../gpu/drm/amd/display/dc/dce60/dce60_resource.c | 59 +++-- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 +- .../display/dc/resource/dce100/dce100_resource.c | 10 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 10 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 ++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 ++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 + drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 ++- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 + drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 4 + drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/mediatek/airoha_eth.c | 18 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 6 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/phy/sfp.c | 7 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/spi/spi-cadence-quadspi.c | 13 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/target/loopback/tcm_loop.c | 52 +++- drivers/thermal/thermal_core.c | 1 + drivers/thunderbolt/nhi.c | 2 +- drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++- drivers/usb/gadget/function/f_eem.c | 59 +++-- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++-- drivers/usb/gadget/function/f_subset.c | 63 +++-- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++- drivers/usb/gadget/function/f_uvc.c | 39 ++- drivers/usb/gadget/function/u_ecm.h | 21 +- drivers/usb/gadget/function/u_eem.h | 21 +- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 +- drivers/usb/gadget/function/u_rndis.h | 31 ++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/inode.c | 6 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/ext4/fast_commit.c | 4 +- fs/ext4/inode.c | 15 +- fs/smb/server/smb2pdu.c | 121 ++++++--- fs/smb/server/smbacl.c | 43 +++ fs/smb/server/smbacl.h | 2 + include/linux/io_uring_types.h | 9 - include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/swapops.h | 27 +- include/net/netfilter/nf_conntrack_expect.h | 20 +- io_uring/io_uring.c | 15 +- io_uring/io_uring.h | 1 - io_uring/kbuf.c | 289 ++++++++++----------- io_uring/kbuf.h | 148 +++-------- io_uring/net.c | 149 ++++++----- io_uring/poll.c | 4 - io_uring/rw.c | 58 +++-- kernel/bpf/verifier.c | 87 ++++++- kernel/sched/fair.c | 12 +- mm/gup.c | 10 +- mm/hmm.c | 2 +- mm/memory.c | 22 +- mm/mprotect.c | 2 +- mm/sparse-vmemmap.c | 2 +- mm/vmscan.c | 2 +- net/atm/lec.c | 72 +++-- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 ++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 38 ++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 +-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 +- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++---- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 +++++++++----- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 +-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++- sound/soc/intel/boards/Kconfig | 2 - sound/usb/caiaq/device.c | 2 +- tools/objtool/check.c | 5 +- .../testing/selftests/bpf/prog_tests/reg_bounds.c | 62 ++++- .../testing/selftests/bpf/progs/verifier_bounds.c | 159 +++++++++++- 219 files changed, 2644 insertions(+), 1289 deletions(-)

1 month, 1 week

8
7
0 0

[PATCH 6.18 000/277] 6.18.22-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.22 release. There are 277 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.22-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.22-rc1 Andrea Righi <arighi(a)nvidia.com> sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Tejun Heo <tj(a)kernel.org> sched_ext: Refactor do_enqueue_task() local and global DSQ paths David Hildenbrand (Arm) <david(a)kernel.org> mm/memory: fix PMD/PUD checks in follow_pfnmap_start() Anshuman Khandual <anshuman.khandual(a)arm.com> mm: replace READ_ONCE() with standard page table accessors Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> scsi: target: file: Use kzalloc_flex for aio_cmd Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: Fix DCE LVDS handling Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Petr Mladek <pmladek(a)suse.com> kallsyms: prevent module removal when printing module name and buildid Petr Mladek <pmladek(a)suse.com> kallsyms: cleanup code for appending the module buildid Petr Mladek <pmladek(a)suse.com> kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() Petr Mladek <pmladek(a)suse.com> kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Aditya Garg <gargaditya08(a)live.com> HID: appletb-kbd: add .resume method in PM Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: thunderbolt: Set enter_vdo during initialization Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Address thermal zone removal races with resume Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Changwoo Min <changwoo(a)igalia.com> sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Srujana Challa <schalla(a)marvell.com> virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Nicolas Pitre <nico(a)fluxnic.net> vt: resize saved unicode buffer on alt screen exit after resize Liav Mordouch <liavmordouch(a)gmail.com> vt: discard stale unicode buffer on alt screen exit after resize Dave Penkler <dpenkler(a)gmail.com> gpib: Fix fluke driver s390 compile issue Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix memory leak with CCA cards used as accelerator Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: sc7280: make use of common helpers Jens Axboe <axboe(a)kernel.dk> io_uring: protect remaining lockless ctx->rings accesses with RCU Dmitry Torokhov <dmitry.torokhov(a)gmail.com> x86/platform/geode: Fix on-stack property data use-after-return bug Guan-Yu Lin <guanyulin(a)google.com> usb: core: use dedicated spinlock for offload state Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Guan-Yu Lin <guanyulin(a)google.com> usb: host: xhci-sideband: delegate offload_usage tracking to class drivers Felix Gu <ustc.gu(a)gmail.com> usb: misc: usbio: Fix URB memory leak on submit failure Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Johan Hovold <johan(a)kernel.org> gpib: lpvo_usb: fix memory leak on disconnect Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: reduce the scope on unexpected reset Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() Aldo Conte <aldocontelk(a)gmail.com> iio: light: veml6070: fix veml6070_read() return value David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: imu: adis16550: fix swapped gyro/accel filter functions Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl313: add missing error check in predisable Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ade9000: move mutex init before IRQ registration Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong return type in streaming push Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: normalize return value of gpio_get Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: validate doorbell_offset in user queue creation Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix wait after reset sequence in S4 Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: fix quaternion alignment David Lechner <dlechner(a)baylibre.com> iio: add IIO_DECLARE_QUATERNION() macro Adam Crosser <adam.crosser(a)praetorian.com> gpib: fix use-after-free in IO ioctl handlers Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Sourav Nayak <nonameblank007(a)gmail.com> ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Cheng-Yang Chou <yphbchou0911(a)gmail.com> sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Alice Ryhl <aliceryhl(a)google.com> rust_binder: use AssertSync for BINDER_VM_OPS Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Sunil V L <sunilvl(a)oss.qualcomm.com> ACPI: RIMT: Add dependency between iommu and devices Zishun Yi <vulab(a)iscas.ac.cn> riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Ian Rogers <irogers(a)google.com> perf/x86: Fix potential bad container_of in intel_pmu_hw_config Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Corey Hickey <bugfood-c(a)fatooh.org> hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI Chen Ni <nichen(a)iscas.ac.cn> drm/sysfb: Fix efidrm error handling and memory type mismatch Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Felix Gu <ustc.gu(a)gmail.com> spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clear restart flag in pxp_start after jumping back Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Remove incorrect handling of impossible state during suspend Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clean up termination status on failure Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix reset control leak on probe error Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix resource leak in remove() callback Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix array access with zero-length block read Qi Tang <tpluszz77(a)gmail.com> io_uring/rsrc: reject zero-length fixed buffer import Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away Barnabás Pőcze <pobrn(a)protonmail.com> gpiolib: clear requested flag if line is invalid Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio() David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_h4: Fix race during initialization Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP Michal Piekos <michal.piekos(a)mmpsystems.pl> net: stmmac: skip VLAN restore when VLAN hash ops are missing Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Geliang Tang <geliang(a)kernel.org> mptcp: add eat_recv_skb helper Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Revert to operating out-of-place Pengpeng Hou <pengpeng(a)iscas.ac.cn> bnxt_en: set backing store type from query type Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Dag Smedberg <dag(a)dsmedberg.se> ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP Wei Fang <wei.fang(a)nxp.com> net: enetc: do not allow VF to configure the RSS key Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Wei Fang <wei.fang(a)nxp.com> net: enetc: reset PIR and CIR if they are not equal when initializing TX ring Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Qingfang Deng <dqfext(a)gmail.com> netdevsim: fix build if SKB_EXTENSIONS=n Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Fix RX skb truesize accounting Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Mikulas Patocka <mpatocka(a)redhat.com> crypto: deflate - fix spurious -ENOSPC Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: mld: correctly set wifi generation data Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: disable EHT if the device doesn't allow it Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: cfg: add new device names Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't send a 6E related command when not supported Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mld: Fix MLO scan timing Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: fix remaining kernel-doc warnings Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR Paulo Alcantara <pc(a)manguebit.org> smb: client: fix generic/694 due to wrong ->i_blocks ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Lee Jones <lee(a)kernel.org> HID: core: Mitigate potential OOB by removing bogus memset() Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/riscv/kernel/process.c | 4 +- arch/s390/kernel/perf_cpum_sf.c | 6 +- arch/x86/events/intel/core.c | 6 +- arch/x86/kernel/Makefile | 14 ++ arch/x86/mm/Makefile | 2 + arch/x86/platform/geode/geode-common.c | 24 ++- crypto/af_alg.c | 53 ++---- crypto/algif_aead.c | 100 ++--------- crypto/algif_skcipher.c | 6 +- crypto/authencesn.c | 50 +++--- crypto/deflate.c | 11 +- drivers/accel/qaic/qaic_control.c | 47 ++++- drivers/acpi/riscv/rimt.c | 7 + drivers/android/binder/page_range.rs | 8 +- drivers/android/binder/rust_binder_main.rs | 2 +- drivers/bluetooth/hci_h4.c | 3 - drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 ++ drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 ++-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 +++---- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++-- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpio/gpio-aspeed.c | 6 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpio/gpiolib-cdev.c | 12 +- drivers/gpio/gpiolib-sysfs.c | 14 +- drivers/gpio/gpiolib.c | 175 +++++++++--------- drivers/gpio/gpiolib.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 17 +- .../display/dc/resource/dce100/dce100_resource.c | 5 +- .../display/dc/resource/dce110/dce110_resource.c | 5 +- .../display/dc/resource/dce112/dce112_resource.c | 5 +- .../display/dc/resource/dce120/dce120_resource.c | 5 +- .../amd/display/dc/resource/dce60/dce60_resource.c | 13 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/sysfb/efidrm.c | 46 +++-- drivers/gpu/drm/xe/xe_pxp.c | 11 +- drivers/hid/hid-appletb-kbd.c | 5 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 ++ drivers/hwmon/asus-ec-sensors.c | 7 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 10 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl313_core.c | 2 + drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ade9000.c | 12 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 +++-- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/adc/ti-ads7950.c | 8 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++-- drivers/iio/imu/adis16550.c | 8 +- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/light/veml6070.c | 4 +- drivers/iio/orientation/hid-sensor-rotation.c | 24 ++- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 5 +- drivers/misc/mei/hw-me.c | 14 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/ethernet/airoha/airoha_eth.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 13 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +- drivers/net/phy/sfp.c | 7 +- drivers/net/virtio_net.c | 20 +-- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 1 + drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 24 +++ drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 1 + drivers/net/wireless/intel/iwlwifi/fw/api/cmdhdr.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/api/coex.h | 4 +- .../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 + .../net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 14 +- drivers/net/wireless/intel/iwlwifi/fw/api/debug.h | 2 +- .../net/wireless/intel/iwlwifi/fw/api/location.h | 8 +- drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 5 +- drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 88 +++++---- drivers/net/wireless/intel/iwlwifi/fw/api/sta.h | 6 +- drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 39 ++-- drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 2 +- drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/file.h | 74 ++++++-- drivers/net/wireless/intel/iwlwifi/fw/img.h | 12 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 22 ++- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 8 +- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 +- drivers/net/wireless/intel/iwlwifi/iwl-modparams.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 17 +- drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h | 1 + drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 6 +- drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++---- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +- drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 5 + drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/s390/crypto/zcrypt_msgtype6.c | 32 ++-- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++ drivers/spi/spi-cadence-quadspi.c | 17 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/spi/spi-stm32-ospi.c | 9 +- drivers/staging/gpib/Kconfig | 1 + drivers/staging/gpib/common/gpib_os.c | 96 +++++++--- drivers/staging/gpib/include/gpib_types.h | 8 + drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 +- drivers/target/loopback/tcm_loop.c | 52 +++++- drivers/target/target_core_file.c | 2 +- drivers/thermal/thermal_core.c | 32 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/vt/vt.c | 18 ++ drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/driver.c | 23 ++- drivers/usb/core/offload.c | 102 ++++++----- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/core/usb.c | 1 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++-- drivers/usb/gadget/function/f_eem.c | 59 ++++--- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++++-- drivers/usb/gadget/function/f_subset.c | 63 ++++--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++-- drivers/usb/gadget/function/f_uvc.c | 39 +++- drivers/usb/gadget/function/u_ecm.h | 21 ++- drivers/usb/gadget/function/u_eem.h | 21 ++- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 ++- drivers/usb/gadget/function/u_rndis.h | 31 +++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci-sideband.c | 18 +- drivers/usb/misc/usbio.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/altmodes/thunderbolt.c | 44 ++--- drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/smb/client/cifsglob.h | 6 + fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 +-- fs/smb/client/smb2ops.c | 20 +-- fs/smb/server/smb2pdu.c | 121 +++++++++---- fs/smb/server/smbacl.c | 43 +++++ fs/smb/server/smbacl.h | 2 + include/crypto/if_alg.h | 5 +- include/linux/iio/iio.h | 12 ++ include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/skbuff.h | 1 + include/linux/usb.h | 10 +- include/net/netfilter/nf_conntrack_expect.h | 20 ++- io_uring/io_uring.c | 62 ++++--- io_uring/io_uring.h | 34 +++- io_uring/net.c | 4 + io_uring/rsrc.c | 4 + kernel/bpf/verifier.c | 10 +- kernel/kallsyms.c | 64 +++++-- kernel/sched/ext.c | 70 +++++--- kernel/sched/ext_idle.c | 33 ++-- kernel/sched/fair.c | 10 +- kernel/trace/bpf_trace.c | 4 + lib/crypto/chacha-block-generic.c | 4 + mm/gup.c | 10 +- mm/hmm.c | 2 +- mm/memory.c | 22 ++- mm/mprotect.c | 2 +- mm/sparse-vmemmap.c | 2 +- mm/vmscan.c | 2 +- net/atm/lec.c | 72 +++++--- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 33 ++-- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 +++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 38 +++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 ++-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 ++ net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mptcp/protocol.c | 30 ++-- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 ++- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++------ net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++------- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 +++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 ++-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/hda/codecs/realtek/alc269.c | 2 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++-- sound/soc/intel/boards/Kconfig | 2 - sound/soc/qcom/sdw.c | 11 ++ sound/usb/caiaq/device.c | 2 +- sound/usb/qcom/qc_audio_offload.c | 10 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 5 +- 309 files changed, 3178 insertions(+), 1635 deletions(-)

1 month, 1 week

8
7
0 0

[PATCH 6.19 000/311] 6.19.12-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.12 release. There are 311 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.12-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.12-rc1 Alexander Popov <alex.popov(a)linux.com> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Petr Mladek <pmladek(a)suse.com> kallsyms: prevent module removal when printing module name and buildid Petr Mladek <pmladek(a)suse.com> kallsyms: cleanup code for appending the module buildid Petr Mladek <pmladek(a)suse.com> kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() Petr Mladek <pmladek(a)suse.com> kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() Taegu Ha <hataegu0826(a)gmail.com> usb: gadget: f_uac1_legacy: validate control request size Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: move list and spinlock inits from bind to alloc Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_eem: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_ecm: Fix net_device lifecycle with device_move Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_rndis: Protect RNDIS options with mutex Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Jimmy Hu <hhhuuu(a)google.com> usb: gadget: uvc: fix NULL pointer dereference during unbind race Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Kuen-Han Tsai <khtsai(a)google.com> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Aditya Garg <gargaditya08(a)live.com> HID: appletb-kbd: add .resume method in PM Nathan Rebello <nathan.c.rebello(a)gmail.com> usb: typec: ucsi: validate connector number in ucsi_notify_common() Sebastian Urban <surban(a)surban.net> usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix interrupt synchronization error Alan Stern <stern(a)rowland.harvard.edu> USB: dummy-hcd: Fix locking/synchronization error Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> thunderbolt: Fix property read in nhi_wake_supported() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: thunderbolt: Set enter_vdo during initialization Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe Xingjing Deng <micro6947(a)gmail.com> misc: fastrpc: possible double-free of cctx->remote_heap Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone device registration error path Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Address thermal zone removal races with resume Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Shenwei Wang <shenwei.wang(a)nxp.com> gpio: mxc: map Both Edge pad wakeup to Rising Edge Andrea Righi <arighi(a)nvidia.com> sched_ext: Fix stale direct dispatch state in ddsp_dsq_id Changwoo Min <changwoo(a)igalia.com> sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU Guangshuo Li <lgs201920130244(a)gmail.com> cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Srujana Challa <schalla(a)marvell.com> virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN Jason Gunthorpe <jgg(a)ziepe.ca> iommupt: Fix short gather if the unmap goes into a large mapping Sven Eckelmann (Plasma Cloud) <se(a)simonwunderlich.de> net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled Yufan Chen <yufan.chen(a)linux.dev> net: ftgmac100: fix ring allocation unwind on open failure Yang Yang <n05ec(a)lzu.edu.cn> vxlan: validate ND option lengths in vxlan_na_create Eric Biggers <ebiggers(a)kernel.org> crypto: tegra - Add missing CRYPTO_ALG_ASYNC Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member Cosmin Tanislav <cosmin-gabriel.tanislav.xa(a)renesas.com> counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Nicolas Pitre <nico(a)fluxnic.net> vt: resize saved unicode buffer on alt screen exit after resize Liav Mordouch <liavmordouch(a)gmail.com> vt: discard stale unicode buffer on alt screen exit after resize Dave Penkler <dpenkler(a)gmail.com> gpib: Fix fluke driver s390 compile issue Yifan Wu <yifanwucs(a)gmail.com> netfilter: ipset: drop logically empty buckets in mtype_del Ivan Vera <ivanverasantos(a)gmail.com> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Christian Eggers <ceggers(a)arri.de> nvmem: imx: assign nvmem_cell_info::raw_len Changwoo Min <changwoo(a)igalia.com> PM: EM: Fix NULL pointer dereference when perf domain ID is not found Guangshuo Li <lgs201920130244(a)gmail.com> reset: gpio: fix double free in reset_add_gpio_aux_device() error path Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_sf: Cap sampling rate to prevent lsctl exception Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix memory leak with CCA cards used as accelerator Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> spi: cadence-qspi: Fix exec_mem_op error handling Xu Yang <xu.yang_2(a)nxp.com> dt-bindings: connector: add pd-disable dependency Conor Dooley <conor.dooley(a)microchip.com> firmware: microchip: fail auto-update probe if no flash found Ian Abbott <abbotti(a)mev.co.uk> comedi: me4000: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: me_daq: Fix potential overrun of firmware buffer Ian Abbott <abbotti(a)mev.co.uk> comedi: ni_atmio16d: Fix invalid clean-up after failed attach Ian Abbott <abbotti(a)mev.co.uk> comedi: Reinit dev->spinlock between attachments to low-level drivers Edward Adam Davis <eadavis(a)qq.com> comedi: runflags cannot determine whether to reclaim chanlist Deepanshu Kartikey <kartikey406(a)gmail.com> comedi: dt2815: add hardware detection to prevent crash Oliver Neukum <oneukum(a)suse.com> cdc-acm: new quirk for EPSON HMD Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: validate ND option lengths Guangshuo Li <lgs201920130244(a)gmail.com> auxdisplay: line-display: fix NULL dereference in linedisp_release Jens Axboe <axboe(a)kernel.dk> io_uring: protect remaining lockless ctx->rings accesses with RCU Dmitry Torokhov <dmitry.torokhov(a)gmail.com> x86/platform/geode: Fix on-stack property data use-after-return bug Guan-Yu Lin <guanyulin(a)google.com> usb: core: use dedicated spinlock for offload state Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix state inconsistency on gadget init failure Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Gabor Juhos <j4g8y7(a)gmail.com> usb: core: phy: avoid double use of 'usb3-phy' Juno Choi <juno.choi(a)lge.com> usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen <justin.chen(a)broadcom.com> usb: ehci-brcm: fix sleep during atomic Guan-Yu Lin <guanyulin(a)google.com> usb: host: xhci-sideband: delegate offload_usage tracking to class drivers Felix Gu <ustc.gu(a)gmail.com> usb: misc: usbio: Fix URB memory leak on submit failure Heitor Alves de Siqueira <halves(a)igalia.com> usb: usbtmc: Flush anchored URBs in usbtmc_release Guangshuo Li <lgs201920130244(a)gmail.com> usb: ulpi: fix double free in ulpi_register_interface() error path Miao Li <limiao(a)kylinos.cn> usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Johan Hovold <johan(a)kernel.org> gpib: lpvo_usb: fix memory leak on disconnect Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: reduce the scope on unexpected reset Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix out-of-sequence free_irq() Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Move iio_device_register() to correct location Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix irq resource leak Ethan Tidmore <ethantidmore06(a)gmail.com> iio: gyro: mpu3050: Fix incorrect free_irq() variable Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only Francesco Lavra <flavra(a)baylibre.com> iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Josh Poimboeuf <jpoimboe(a)kernel.org> iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() Aldo Conte <aldocontelk(a)gmail.com> iio: light: veml6070: fix veml6070_read() return value David Lechner <dlechner(a)baylibre.com> iio: light: vcnl4035: fix scan buffer on big-endian Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: imu: adis16550: fix swapped gyro/accel filter functions Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: dac: ad5770r: fix error return in ad5770r_read_raw() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl313: add missing error check in predisable Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 Valek Andrej <andrej.v(a)skyrain.eu> iio: accel: fix ADXL355 temperature signature value Billy Tsai <billy_tsai(a)aspeedtech.com> iio: adc: aspeed: clear reference voltage bits before configuring vref Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: adc: ade9000: move mutex init before IRQ registration Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power Giorgi Tchankvetadze <giorgitchankvetadze1997(a)gmail.com> iio: adc: ade9000: fix wrong return type in streaming push Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> iio: adc: ti-ads7950: normalize return value of gpio_get Zoltan Illes <zoliviragh(a)gmail.com> Input: xpad - add support for Razer Wolverine V3 Pro Shengyu Qu <wiagn233(a)outlook.com> Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Liam Mitchell <mitchell.liam(a)gmail.com> Input: bcm5974 - recover from failed mode switch Christoffer Sandberg <cs(a)tuxedo.de> Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Bart Van Assche <bvanassche(a)acm.org> Input: synaptics-rmi4 - fix a locking bug in an error path JP Hein <jp(a)jphein.com> USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Wanquan Zhong <wanquan.zhong(a)fibocom.com> USB: serial: option: add support for Rolling Wireless RW135R-GL Frej Drejhammar <frej(a)stacken.kth.se> USB: serial: io_edgeport: add support for Blackbox IC135A Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: drop SMU driver if version not matched messages Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: validate doorbell_offset in user queue creation Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix wait after reset sequence in S4 Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: dp501: Fix initialization of SCU2C Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() Felix Gu <ustc.gu(a)gmail.com> iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-adc161s626: fix buffer read on big-endian David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace David Lechner <dlechner(a)baylibre.com> iio: orientation: hid-sensor-rotation: fix quaternion alignment David Lechner <dlechner(a)baylibre.com> iio: add IIO_DECLARE_QUATERNION() macro Adam Crosser <adam.crosser(a)praetorian.com> gpib: fix use-after-free in IO ioctl handlers Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: fix the idr allocation flags Aleksandr Nogikh <nogikh(a)google.com> x86/kexec: Disable KCOV instrumentation after load_segments() Stefan Wiehler <stefan.wiehler(a)nokia.com> mips: mm: Allocate tlb_vpn array atomically Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix division by zero in occ_show_power_1() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix the GCC version check for `__multi3' workaround Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: SiByte: Bring back cache initialisation Asim Viladi Oglu Manizada <manizada(a)pm.me> ksmbd: fix OOB write in QUERY_INFO for compound requests Oleh Konko <security(a)1seal.org> Bluetooth: hci_event: move wake reason storage into validated event handlers hkbinbin <hkbinbinbin(a)gmail.com> Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Oleh Konko <security(a)1seal.org> Bluetooth: SMP: force responder MITM requirements before building the pairing response Oleh Konko <security(a)1seal.org> Bluetooth: SMP: derive legacy responder STK authentication from MITM state Junxi Qian <qjx1298677004(a)gmail.com> io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: change quirk for HP OmniBook 7 Laptop 16-bh0xxx Sourav Nayak <nonameblank007(a)gmail.com> ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for Acer Swift SFG14-73 Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Fix missing SPDIFI1 index handling Takashi Iwai <tiwai(a)suse.de> ALSA: ctxfi: Check the error for index mapping Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: fix stack out-of-bounds read in init_card Tejun Heo <tj(a)kernel.org> sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback Eric Biggers <ebiggers(a)kernel.org> lib/crypto: chacha: Zeroize permuted_state before it leaves scope Cheng-Yang Chou <yphbchou0911(a)gmail.com> sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() Ernestas Kulik <ernestas.k(a)iconn-networks.com> USB: serial: option: add MeiG Smart SRM825WN Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Alice Ryhl <aliceryhl(a)google.com> rust_binder: use AssertSync for BINDER_VM_OPS Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/ioc32: stop speculation on the drm_compat_ioctl path Sunil V L <sunilvl(a)oss.qualcomm.com> ACPI: RIMT: Add dependency between iommu and devices Zishun Yi <vulab(a)iscas.ac.cn> riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set Paul Walmsley <pjw(a)kernel.org> riscv: kgdb: fix several debug register assignment bugs Ian Rogers <irogers(a)google.com> perf/x86: Fix potential bad container_of in intel_pmu_hw_config Peter Zijlstra <peterz(a)infradead.org> sched/debug: Fix avg_vruntime() usage Peter Zijlstra <peterz(a)infradead.org> sched/fair: Fix zero_vruntime tracking fix Shiji Yang <yangshiji66(a)outlook.com> mips: ralink: update CPU clock index Corey Hickey <bugfood-c(a)fatooh.org> hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI Chen Ni <nichen(a)iscas.ac.cn> drm/sysfb: Fix efidrm error handling and memory type mismatch Jessica Liu <liu.xuemei1(a)zte.com.cn> irqchip/riscv-aplic: Restrict genpd notifier to device tree only Sanman Pradhan <psanman(a)juniper.net> hwmon: (occ) Fix missing newline in occ_show_extended() Felix Gu <ustc.gu(a)gmail.com> spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clear restart flag in pxp_start after jumping back Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Remove incorrect handling of impossible state during suspend Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: Clean up termination status on failure Jonathan Cavitt <jonathan.cavitt(a)intel.com> drm/xe/xe_pagefault: Disallow writes to read-only VMAs Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix reset control leak on probe error Felix Gu <ustc.gu(a)gmail.com> spi: stm32-ospi: Fix resource leak in remove() callback Jamie Gibbons <jamie.gibbons(a)microchip.com> dt-bindings: gpio: fix microchip #interrupt-cells Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: shorten the critical section in gpiochip_setup_shared() Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") Sanman Pradhan <psanman(a)juniper.net> hwmon: (pxe1610) Check return value of page-select write in probe Sanman Pradhan <psanman(a)juniper.net> hwmon: (tps53679) Fix array access with zero-length block read Qi Tang <tpluszz77(a)gmail.com> io_uring/rsrc: reject zero-length fixed buffer import Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> accel/qaic: Handle DBC deactivation if the owner went away Liu Ying <victor.liu(a)nxp.com> drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show() Felix Gu <ustc.gu(a)gmail.com> gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: handle pins shared by child nodes of devices Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: shared: call gpio_chip::of_xlate() if set Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org> interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() Barnabás Pőcze <pobrn(a)protonmail.com> gpiolib: clear requested flag if line is invalid David Lechner <dlechner(a)baylibre.com> iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Maarten Lankhorst <dev(a)lankhorst.se> Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect pruning due to atomic fetch precision tracking Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Qi Tang <tpluszz77(a)gmail.com> bpf: reject direct access to nullable PTR_TO_BUF pointers Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 Eric Dumazet <edumazet(a)google.com> ipv6: avoid overflows in ip6_datagram_send_ctl() Luka Gejak <luka.gejak(a)linux.dev> net: hsr: fix VLAN add unwind on slave errors Xiang Mei <xmei5(a)asu.edu> net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xiang Mei <xmei5(a)asu.edu> net/sched: cls_fw: fix NULL pointer dereference on shared blocks Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix overflow when accumulating packets Martin Schiller <ms(a)dev.tdt.de> net/x25: Fix potential double free of skb Pavan Chebbi <pavan.chebbi(a)broadcom.com> bnxt_en: Restore default stat ctxs for ULP when resource is available Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Refactor some basic ring setup and adjustment logic Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Fix switchdev mode rollback in case of failure Saeed Mahameed <saeedm(a)nvidia.com> net/mlx5: Avoid "No data available" when FW version queries fail Shay Drory <shayd(a)nvidia.com> net/mlx5: lag: Check for LAG device before creating debugfs Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: properly unregister fixed rate clocks Fedor Pchelkin <pchelkin(a)ispras.ru> net: macb: fix clk handling on PCI glue driver removal Yucheng Lu <kanolyc(a)gmail.com> net/sched: sch_netem: fix out-of-bounds access in packet corruption Kuniyuki Iwashima <kuniyu(a)google.com> bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Weiming Shi <bestswngs(a)gmail.com> rds: ib: reject FRMR registration before IB connection is established Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate mesh send advertising payload length Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Keenan Dong <keenanat2000(a)gmail.com> Bluetooth: MGMT: validate LTK enc_size on load Jonathan Rissanen <jonathan.rissanen(a)axis.com> Bluetooth: hci_h4: Fix race during initialization Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Fix UAF in le_read_features_complete Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Add support for setting BT_PHY Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: SCO: fix race conditions in sco_sock_connect() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject immediate NF_QUEUE verdict Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ignore explicit helper on new expectations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: store netns and zone in expectation Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: use expect->helper Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: honor expectation helper field Qi Tang <tpluszz77(a)gmail.com> netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Qi Tang <tpluszz77(a)gmail.com> netfilter: nf_conntrack_helper: pass helper to expect cleanup Florian Westphal <fw(a)strlen.de> netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Florian Westphal <fw(a)strlen.de> netfilter: x_tables: ensure names are nul-terminated Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_log: account for netlink header size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: strictly check for maximum number of actions Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP Michal Piekos <michal.piekos(a)mmpsystems.pl> net: stmmac: skip VLAN restore when VLAN hash ops are missing Li Xiasong <lixiasong1(a)huawei.com> mptcp: fix soft lockup in mptcp_recvmsg() Geliang Tang <geliang(a)kernel.org> mptcp: add eat_recv_skb helper Zhengchuan Liang <zcliangcn(a)gmail.com> net: ipv6: flowlabel: defer exclusive option free until RCU teardown Alexei Starovoitov <ast(a)kernel.org> bpf: Fix regsafe() for pointers to packet Xiang Mei <xmei5(a)asu.edu> bridge: mrp: reject zero test interval to avoid OOM panic Julian Braha <julianbraha(a)gmail.com> ASoC: Intel: boards: fix unmet dependency on PINCTRL Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets Suraj Gupta <suraj.gupta2(a)amd.com> net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Pengpeng Hou <pengpeng(a)iscas.ac.cn> NFC: pn533: bound the UART receive buffer Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Revert to operating out-of-place Pengpeng Hou <pengpeng(a)iscas.ac.cn> bnxt_en: set backing store type from query type Yochai Eisenrich <echelonh(a)gmail.com> net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Guoyu Su <yss2813483011xxl(a)gmail.com> net: use skb_header_pointer() for TCPv4 GSO frag_off check Paolo Abeni <pabeni(a)redhat.com> net: introduce mangleid_features Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() Paolo Abeni <pabeni(a)redhat.com> ipv6: prevent possible UaF in addrconf_permanent_addr() Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Dag Smedberg <dag(a)dsmedberg.se> ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP Wei Fang <wei.fang(a)nxp.com> net: enetc: do not allow VF to configure the RSS key Wei Fang <wei.fang(a)nxp.com> net: enetc: check whether the RSS algorithm is Toeplitz Marek Behún <kabel(a)kernel.org> net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Xiang Mei <xmei5(a)asu.edu> net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Yang Yang <n05ec(a)lzu.edu.cn> bridge: br_nd_send: linearize skb before parsing ND options Dimitri Daskalakis <daskald(a)meta.com> eth: fbnic: Account for page fragments when updating BDQ tail Eric Dumazet <edumazet(a)google.com> ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Eric Dumazet <edumazet(a)google.com> ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() David Carlier <devnexen(a)gmail.com> net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch Thomas Bogendoerfer <tbogendoerfer(a)suse.de> tg3: Fix race for querying speed/duplex Pengpeng Hou <pengpeng(a)iscas.ac.cn> net/ipv6: ioam6: prevent schema length wraparound in trace fill Sherry Yang <sherry.yang(a)oracle.com> iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline Yochai Eisenrich <echelonh(a)gmail.com> net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Jiayuan Chen <jiayuan.chen(a)shopee.com> net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Wei Fang <wei.fang(a)nxp.com> net: enetc: do not access non-existent registers on pseudo MAC Wei Fang <wei.fang(a)nxp.com> net: enetc: add graceful stop to safely reinitialize the TX Ring Wei Fang <wei.fang(a)nxp.com> net: enetc: reset PIR and CIR if they are not equal when initializing TX ring Buday Csaba <buday.csaba(a)prolan.hu> net: fec: fix the PTP periodic output sysfs interface Qingfang Deng <dqfext(a)gmail.com> netdevsim: fix build if SKB_EXTENSIONS=n Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: mana: Fix RX skb truesize accounting Sabrina Dubroca <sd(a)queasysnail.net> mpls: add seqcount to protect the platform_label{,s} pair Norbert Szetei <norbert(a)doyensec.com> crypto: af-alg - fix NULL pointer dereference in scatterwalk Mikulas Patocka <mpatocka(a)redhat.com> crypto: deflate - fix spurious -ENOSPC Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix overflow on long hmac keys Horia Geantă <horia.geanta(a)nxp.com> crypto: caam - fix DMA corruption on long hmac keys Tejun Heo <tj(a)kernel.org> cgroup: Fix cgroup_drain_dying() testing the wrong condition Tejun Heo <tj(a)kernel.org> selftests/cgroup: Don't require synchronous populated update on task exit Tejun Heo <tj(a)kernel.org> cgroup: Wait for dying tasks to leave on rmdir Reshma Immaculate Rajkumar <reshma.rajkumar(a)oss.qualcomm.com> wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: mld: correctly set wifi generation data Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: don't send a 6E related command when not supported Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mld: Fix MLO scan timing Frank Li <Frank.Li(a)nxp.com> dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix error handling in mshv_region_pin Praveen Talari <praveen.talari(a)oss.qualcomm.com> spi: geni-qcom: Check DMA interrupts early in ISR Paulo Alcantara <pc(a)manguebit.org> smb: client: fix generic/694 due to wrong ->i_blocks Alex Hung <alex.hung(a)amd.com> drm/amd/display: Fix gamma 2.2 colorop TFs ZhengYuan Huang <gality369(a)gmail.com> btrfs: reject root items with drop_progress and zero drop_level Mikko Perttunen <mperttunen(a)nvidia.com> i2c: tegra: Don't mark devices with pins as IRQ safe Filipe Manana <fdmanana(a)suse.com> btrfs: reserve enough transaction items for qgroup ioctls Lee Jones <lee(a)kernel.org> HID: multitouch: Check to ensure report responses match the request Joe Lawrence <joe.lawrence(a)redhat.com> objtool/klp: fix mkstemp() failure with long paths Lee Jones <lee(a)kernel.org> HID: core: Mitigate potential OOB by removing bogus memset() Lee Jones <lee(a)kernel.org> HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Fix Clang jump table detection Paul SAGE <paul.sage(a)42.fr> tg3: replace placeholder MAC address with device property Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't take device_list_mutex when querying zone info Deepanshu Kartikey <kartikey406(a)gmail.com> atm: lec: fix use-after-free in sock_def_readable() Benoît Sevens <bsevens(a)google.com> HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Deepanshu Kartikey <kartikey406(a)gmail.com> wifi: mac80211: check tdls flag in ieee80211_tdls_oper Adrian Freund <adrian(a)freund.io> HID: logitech-hidpp: Enable MX Master 4 over bluetooth Pepper Gray <hello(a)peppergray.xyz> arm64/scs: Fix handling of advance_loc4 Long Li <leo.lilong(a)huawei.com> xfs: close crash window in attr dabtree inactivation Long Li <leo.lilong(a)huawei.com> xfs: factor out xfs_attr3_leaf_init Long Li <leo.lilong(a)huawei.com> xfs: factor out xfs_attr3_node_entry_remove Josef Bacik <josef(a)toxicpanda.com> scsi: target: tcm_loop: Drain commands in target_reset handler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> scsi: target: file: Use kzalloc_flex for aio_cmd Guangshuo Li <lgs201920130244(a)gmail.com> net: mana: fix use-after-free in add_adev() error path Willem de Bruijn <willemb(a)google.com> net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 ------------- Diffstat: .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/riscv/kernel/process.c | 4 +- arch/s390/kernel/perf_cpum_sf.c | 6 +- arch/x86/events/intel/core.c | 6 +- arch/x86/kernel/Makefile | 14 ++ arch/x86/mm/Makefile | 2 + arch/x86/platform/geode/geode-common.c | 24 ++- crypto/af_alg.c | 53 ++---- crypto/algif_aead.c | 100 ++--------- crypto/algif_skcipher.c | 6 +- crypto/authencesn.c | 50 +++--- crypto/deflate.c | 11 +- drivers/accel/qaic/qaic_control.c | 47 ++++- drivers/acpi/riscv/rimt.c | 7 + drivers/android/binder/page_range.rs | 8 +- drivers/android/binder/rust_binder_main.rs | 2 +- drivers/auxdisplay/line-display.c | 2 +- drivers/bluetooth/hci_h4.c | 3 - drivers/comedi/comedi_fops.c | 8 +- drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 ++ drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 ++-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 +++---- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++-- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpib/Kconfig | 1 + drivers/gpib/common/gpib_os.c | 96 +++++++--- drivers/gpib/include/gpib_types.h | 8 + drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpio/gpio-qixis-fpga.c | 4 +- drivers/gpio/gpiolib-shared.c | 57 ++++-- drivers/gpio/gpiolib-shared.h | 11 +- drivers/gpio/gpiolib.c | 135 +++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_colorop.c | 6 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 17 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_bridge.c | 16 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/i915/display/intel_cdclk.c | 54 ++++++ drivers/gpu/drm/sysfb/efidrm.c | 46 +++-- drivers/gpu/drm/xe/xe_pagefault.c | 6 + drivers/gpu/drm/xe/xe_pxp.c | 11 +- drivers/hid/hid-appletb-kbd.c | 5 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 ++ drivers/hv/mshv_regions.c | 6 +- drivers/hwmon/asus-ec-sensors.c | 7 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 10 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl313_core.c | 2 + drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ade9000.c | 12 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 +++-- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/adc/ti-ads7950.c | 8 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++-- drivers/iio/imu/adis16550.c | 8 +- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 15 +- drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/light/veml6070.c | 4 +- drivers/iio/orientation/hid-sensor-rotation.c | 24 ++- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/interconnect/qcom/sm8450.c | 4 +- drivers/iommu/generic_pt/fmt/amdv1.h | 2 +- drivers/iommu/generic_pt/iommu_pt.h | 2 +- drivers/irqchip/irq-riscv-aplic-main.c | 4 +- drivers/misc/fastrpc.c | 5 +- drivers/misc/mei/hw-me.c | 14 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/ethernet/airoha/airoha_eth.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 76 +++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 13 +- drivers/net/ethernet/freescale/enetc/enetc4_hw.h | 11 ++ drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 118 +++++++++++-- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/ti/icssg/icssg_common.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +- drivers/net/phy/sfp.c | 7 +- drivers/net/virtio_net.c | 20 +-- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- .../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 + drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 10 ++ drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++---- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +- drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/reset/core.c | 1 - drivers/s390/crypto/zcrypt_msgtype6.c | 32 ++-- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++ drivers/spi/spi-cadence-quadspi.c | 17 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/spi/spi-stm32-ospi.c | 9 +- drivers/target/loopback/tcm_loop.c | 52 +++++- drivers/target/target_core_file.c | 2 +- drivers/thermal/thermal_core.c | 32 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/vt/vt.c | 18 ++ drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/driver.c | 23 ++- drivers/usb/core/offload.c | 102 ++++++----- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/core/usb.c | 1 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++-- drivers/usb/gadget/function/f_eem.c | 59 ++++--- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++++-- drivers/usb/gadget/function/f_subset.c | 63 ++++--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++-- drivers/usb/gadget/function/f_uvc.c | 39 +++- drivers/usb/gadget/function/u_ecm.h | 21 ++- drivers/usb/gadget/function/u_eem.h | 21 ++- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 ++- drivers/usb/gadget/function/u_rndis.h | 31 +++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci-sideband.c | 18 +- drivers/usb/misc/usbio.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/altmodes/thunderbolt.c | 44 ++--- drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/smb/client/cifsglob.h | 6 + fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 +-- fs/smb/client/smb2ops.c | 20 +-- fs/smb/server/smb2pdu.c | 121 +++++++++---- fs/smb/server/smbacl.c | 43 +++++ fs/smb/server/smbacl.h | 2 + fs/xfs/libxfs/xfs_attr_leaf.c | 22 +++ fs/xfs/libxfs/xfs_attr_leaf.h | 3 + fs/xfs/libxfs/xfs_da_btree.c | 53 ++++-- fs/xfs/libxfs/xfs_da_btree.h | 2 + fs/xfs/xfs_attr_inactive.c | 99 ++++++----- include/crypto/if_alg.h | 5 +- include/linux/cgroup-defs.h | 3 + include/linux/iio/iio.h | 12 ++ include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/skbuff.h | 1 + include/linux/usb.h | 10 +- include/net/bluetooth/bluetooth.h | 39 ++-- include/net/bluetooth/hci.h | 9 + include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/hci_sync.h | 3 + include/net/netfilter/nf_conntrack_expect.h | 20 ++- include/net/netns/mpls.h | 1 + io_uring/io_uring.c | 62 ++++--- io_uring/io_uring.h | 34 +++- io_uring/net.c | 4 + io_uring/rsrc.c | 4 + kernel/bpf/verifier.c | 37 +++- kernel/cgroup/cgroup.c | 88 ++++++++- kernel/kallsyms.c | 64 +++++-- kernel/power/em_netlink.c | 2 + kernel/sched/debug.c | 4 +- kernel/sched/ext.c | 144 +++++++++++---- kernel/sched/ext_idle.c | 33 ++-- kernel/sched/fair.c | 10 +- kernel/sched/sched.h | 3 + kernel/trace/bpf_trace.c | 4 + lib/crypto/chacha-block-generic.c | 4 + net/atm/lec.c | 72 +++++--- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 113 +++++++++++- net/bluetooth/hci_event.c | 153 ++++++++-------- net/bluetooth/hci_sync.c | 152 +++++++++++++--- net/bluetooth/l2cap_sock.c | 20 ++- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 +++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/bridge/br_mrp_netlink.c | 4 +- net/core/dev.c | 38 +++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 ++-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 ++ net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mpls/af_mpls.c | 29 ++- net/mptcp/protocol.c | 30 ++-- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 ++- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++------ net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++------- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 +++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 ++-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/hda/codecs/realtek/alc269.c | 12 +- sound/pci/ctxfi/ctatc.c | 10 +- sound/pci/ctxfi/ctdaio.c | 82 +++++---- sound/soc/cirrus/ep93xx-i2s.c | 34 ++-- sound/soc/intel/boards/Kconfig | 2 - sound/usb/caiaq/device.c | 2 +- sound/usb/qcom/qc_audio_offload.c | 10 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 5 +- tools/objtool/elf.c | 23 +-- tools/testing/selftests/cgroup/lib/cgroup_util.c | 15 ++ .../selftests/cgroup/lib/include/cgroup_util.h | 2 + tools/testing/selftests/cgroup/test_core.c | 3 +- tools/testing/selftests/cgroup/test_kill.c | 7 +- 311 files changed, 3926 insertions(+), 1765 deletions(-)

1 month, 1 week

9
8
0 0

Potential supply partnership.

by N

Hello lkft-triage, My name is Neil, and I am a Research Assistant in the R&D department of a leading biopharmaceutical company in England. I would like to introduce a potential supply opportunity that may be of mutual interest. Please let me know if you would be interested in receiving further details. Best regards, N. E. O'May

1 month, 1 week

1
0
0 0

[PATCH 6.19 000/342] 6.19.11-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.11 release. There are 342 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 02 Apr 2026 16:16:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.11-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.11-rc1 Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix regressions caused by reusing ident Arnd Bergmann <arnd(a)arndb.de> bug: avoid format attribute warning for clang as well Ye Bin <yebin10(a)huawei.com> ext4: fix mballoc-test.c is not compiled when EXT4_KUNIT_TESTS=M Ye Bin <yebin10(a)huawei.com> ext4: introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper Hao-Yu Yang <naup96721(a)gmail.com> futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() Peter Zijlstra <peterz(a)infradead.org> futex: Require sys_futex_requeue() to have identical flags Biju Das <biju.das.jz(a)bp.renesas.com> irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common() David Howells <dhowells(a)redhat.com> netfs: Fix the handling of stream->front by removing it GuoHan Zhao <zhaoguohan(a)kylinos.cn> xen/privcmd: unregister xenstore notifier on module exit Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error when running device stats on multiple devices fs Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> btrfs: fix leak of kobject name for sub-group space_info Mark Harmstone <mark(a)harmstone.com> btrfs: fix super block offset in error message in btrfs_validate_super() David Howells <dhowells(a)redhat.com> netfs: Fix read abandonment during retry Christian Brauner <brauner(a)kernel.org> selftests/mount_setattr: increase tmpfs size for idmapped mount tests Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix dma_device directions Tuo Li <islituo(a)gmail.com> dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() Deepanshu Kartikey <kartikey406(a)gmail.com> netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry Deepanshu Kartikey <kartikey406(a)gmail.com> netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators Alexander Stein <alexander.stein(a)ew.tq-group.com> dmaengine: xilinx: xdma: Fix regmap init error handling LUO Haowen <luo-hw(a)foxmail.com> dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. Felix Gu <ustc.gu(a)gmail.com> phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix leaking event log memory Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix freeing the allocated ida too late Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix memory leak when a wq is reset Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix possible invalid memory access after FLR Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix crash when the event log is disabled Werner Kasselman <werner(a)verivus.com> ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() Benno Lossin <lossin(a)kernel.org> rust: pin-init: internal: init: document load-bearing fact of field accessors SeongJae Park <sj(a)kernel.org> mm/damon/core: avoid use of half-online-committed context Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off Theodore Ts'o <tytso(a)mit.edu> ext4: always drain queued discard work in ext4_mb_release() Baokun Li <libaokun(a)linux.alibaba.com> ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Theodore Ts'o <tytso(a)mit.edu> ext4: handle wraparound when searching for blocks for indirect mapped blocks Zqiang <qiang.zhang(a)linux.dev> ext4: fix the might_sleep() warnings in kvfree() Jiayuan Chen <jiayuan.chen(a)shopee.com> ext4: fix use-after-free in update_super_work when racing with umount Helen Koike <koike(a)igalia.com> ext4: reject mount if bigalloc with s_first_data_block != 0 Ye Bin <yebin10(a)huawei.com> ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Edward Adam Davis <eadavis(a)qq.com> ext4: avoid infinite loops caused by residual data Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Ye Bin <yebin10(a)huawei.com> ext4: test if inode's all dirty pages are submitted to disk Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Jan Kara <jack(a)suse.cz> ext4: make recently_deleted() properly work with lazy itable initialization Jan Kara <jack(a)suse.cz> ext4: fix fsync(2) for nojournal mode Zhang Yi <yi.zhang(a)huawei.com> ext4: do not check fast symlink during orphan recovery Jan Kara <jack(a)suse.cz> ext4: fix stale xarray tags after writeback Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: convert inline data to extents when truncate exceeds inline size Simon Weber <simon.weber.39(a)gmail.com> ext4: fix journal credit check when setting fscrypt context Darrick J. Wong <djwong(a)kernel.org> xfs: remove file_path tracepoint data Darrick J. Wong <djwong(a)kernel.org> xfs: don't irele after failing to iget in xfs_attri_recover_work Long Li <leo.lilong(a)huawei.com> xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 hongao <hongao(a)uniontech.com> xfs: scrub: unlock dquot before early return in quota scrub Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: avoid dereferencing log items after push callbacks Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: save ailp before dropping the AIL lock in push callbacks Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: stop reclaim before pushing AIL during unmount Max Boone <mboone(a)akamai.com> mm/pagewalk: fix race between concurrent split and refault Josh Law <objecting(a)objecting.org> mm/damon/sysfs: check contexts->nr in repeat_call_fn Josh Law <objecting(a)objecting.org> mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Josh Law <objecting(a)objecting.org> mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm/mseal: update VMA end correctly on merge David Hildenbrand (Arm) <david(a)kernel.org> mm/memory: fix PMD/PUD checks in follow_pfnmap_start() Asad Kamal <asad.kamal(a)amd.com> drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: KVM: Handle the case that EIOINTC's coremap is empty Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Workaround LS2K/LS7A GPU DMA hang bug Xi Ruoyao <xry111(a)xry111.site> LoongArch: vDSO: Emit GNU_EH_FRAME correctly Li Jun <lijun01(a)kylinos.cn> LoongArch: Fix missing NULL checks for kstrdup() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Unlink NV12 planes earlier Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Order OP vs. timeout correctly in __wait_for() Imre Deak <imre.deak(a)intel.com> drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: check if ext_caps is valid in BL setup Alex Hung <alex.hung(a)amd.com> drm/amd/display: Fix drm_edid leak in amdgpu_dm Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: Fix DCE LVDS handling Ruijing Dong <ruijing.dong(a)amd.com> drm/amdgpu: fix strsep() corrupting lockup_timeout on multi-GPU (v3) Eric Huang <jinhuieric.huang(a)amd.com> drm/amdgpu: prevent immediate PASID reuse case Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Protect the driver specific lists Joy Zou <joy.zou(a)nxp.com> dmaengine: fsl-edma: fix channel parameter config for fixed channel requests Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: ensure no clock is generated after last read Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: fix i2c issue when reading multiple messages Davidlohr Bueso <dave(a)stgolabs.net> futex: Clear stale exiting pointer in futex_lock_pi() retry path Pratap Nirujogi <pratap.nirujogi(a)amd.com> i2c: designware: amdisp: Fix resume-probe race condition issue Joanne Koong <joannelkoong(a)gmail.com> iomap: fix invalid folio access when i_blkbits differs from I/O granularity Jassi Brar <jassisinghbrar(a)gmail.com> irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment Milos Nikic <nikic.milos(a)gmail.com> jbd2: gracefully abort on checkpointing state corruptions Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE Kevin Hao <haokexin(a)gmail.com> net: macb: Use dev_consume_skb_any() to free TX SKBs Kevin Hao <haokexin(a)gmail.com> net: macb: Protect access to net_device::ip_ptr with RCU lock Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: ses: Handle positive SCSI error from ses_recv_diag() Tyllis Xu <livelycarpet87(a)gmail.com> scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Amir Goldstein <amir73il(a)gmail.com> ovl: fix wrong detection of 32bit inode numbers Fei Lv <feilv(a)asrmicro.com> ovl: make fsync after metadata copy-up opt-in mount option Abel Vesa <abel.vesa(a)oss.qualcomm.com> phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 Nikunj A Dadhania <nikunj(a)amd.com> x86/fred: Fix early boot failures on SEV-ES/SNP guests Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask Nikunj A Dadhania <nikunj(a)amd.com> x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Joanne Koong <joannelkoong(a)gmail.com> writeback: don't block sync for filesystems with no data integrity guarantees Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Zhan Xusheng <zhanxusheng1024(a)gmail.com> alarmtimer: Fix argument order in alarm_timer_forward() Jiucheng Xu <jiucheng.xu(a)amlogic.com> erofs: add GFP_NOIO in the bio completion if needed Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix double free in dma-buf feature xietangxin <xietangxin(a)yeah.net> virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Zubin Mithra <zsm(a)google.com> virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Paul Moses <p(a)1g4.org> xfrm: iptfs: only publish mode_data after clone setup Roshan Kumar <roshaen09(a)gmail.com> xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Ming Qian <ming.qian(a)oss.nxp.com> media: verisilicon: Fix kernel panic due to __initconst misuse Yuchan Nam <entropy1110(a)gmail.com> media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read Zenghui Yu (Huawei) <zenghui.yu(a)linux.dev> KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Marc Zyngier <maz(a)kernel.org> KVM: arm64: Discard PC update state on vcpu reset Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Correct locked bit width Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> thermal: intel: int340x: soc_slider: Set offset only for balanced mode SeongJae Park <sj(a)kernel.org> mm/damon/stat: monitor all System RAM resources Charles Mirabile <cmirabil(a)redhat.com> kbuild: Delete .builtin-dtbs.S when running make clean Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: conservative: Reset requested_freq on limits change Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: Don't skip cpufreq_frequency_table_cpuinfo() Marc Kleine-Budde <mkl(a)pengutronix.de> can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix tx.buf use-after-free in isotp_sendmsg() Ali Norouzi <ali.norouzi(a)keysight.com> can: gw: fix OOB heap access in cgw_csum_crc8_rel() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload Guangshuo Li <lgs201920130244(a)gmail.com> ASoC: sma1307: fix double free of devm_kzalloc() memory Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: codecs: wcd934x: fix typo in dt parsing Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Add disable clock relinquish workaround for NVL-A0 Alexey Nepomnyashih <sdl(a)nppct.ru> ALSA: firewire-lib: fix uninitialized local variable Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR Mario Limonciello <mario.limonciello(a)amd.com> Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist" Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: do not expire session on binding failure Werner Kasselman <werner(a)verivus.com> ksmbd: fix memory leaks and NULL deref in smb2_lock() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix potencial OOB in get_file_all_info() for compound requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() Matthew Auld <matthew.auld(a)intel.com> drm/xe: always keep track of remap prev/next Luo Haiyang <luo.haiyang(a)zte.com.cn> tracing: Fix potential deadlock in cpu hotplug with osnoise Wesley Atwell <atwellwea(a)gmail.com> tracing: Drain deferred trigger frees if kthread creation fails Vasily Gorbik <gor(a)linux.ibm.com> s390/entry: Scrub r12 register on kernel entry Vasily Gorbik <gor(a)linux.ibm.com> s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> s390/syscalls: Add spectre boundary for syscall dispatch table Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP Nicholas Carlini <nicholas(a)carlini.com> io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check Jens Axboe <axboe(a)kernel.dk> io_uring/fdinfo: fix SQE_MIXED SQE displaying Marc Kleine-Budde <mkl(a)pengutronix.de> spi: spi-fsl-lpspi: fix teardown order issue (UAF) Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix clock leak on PLL lock failure Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix unchecked clk_prepare_enable() return value Marc Buerg <buermarc(a)googlemail.com> sysctl: fix uninitialized variable in proc_do_large_bitmap Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/core) Protect regulator operations with mutex Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Introduce the concept of "write-only" attributes Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only Shuming Fan <shumingf(a)realtek.com> ASoC: SDCA: fix finding wrong entity Sanman Pradhan <psanman(a)juniper.net> hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib Weiming Shi <bestswngs(a)gmail.com> ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Danilo Krummrich <dakr(a)kernel.org> spi: use generic driver_override infrastructure Matt Roper <matthew.d.roper(a)intel.com> drm/xe: Implement recent spec updates to Wa_16025250150 Alice Ryhl <aliceryhl(a)google.com> rust: regulator: do not assume that regulator_get() returns non-null Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix the device initialization Felix Gu <ustc.gu(a)gmail.com> spi: sn-f-ospi: Fix resource leak in f_ospi_probe() Michał Winiarski <michal.winiarski(a)intel.com> drm/xe/pf: Fix use-after-free in migration restore Youngjun Park <youngjun.park(a)lge.com> PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() Alberto Garcia <berto(a)igalia.com> PM: hibernate: Drain trailing zero pages on userspace restore Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Luca Leonardo Scorcia <l.scorcia(a)gmail.com> drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Yihang Li <liyihang9(a)huawei.com> scsi: scsi_transport_sas: Fix the maximum channel scanning issue Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl: imx-card: initialize playback_only and capture_only Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only Shiraz Saleem <shiraz.saleem(a)intel.com> RDMA/irdma: Harden depth calculation functions Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Return EINVAL for invalid arp index error Anil Samal <anil.samal(a)intel.com> RDMA/irdma: Fix deadlock during netdev reset with active connections Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() Ivan Barrera <ivan.d.barrera(a)intel.com> RDMA/irdma: Clean up unnecessary dereference of event->cm_node Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Update ibqp state to error if QP is already in error state Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Initialize free_qp completion before using it Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP Ethan Tidmore <ethantidmore06(a)gmail.com> RDMA/efa: Fix possible deadlock Chuck Lever <chuck.lever(a)oracle.com> RDMA/rw: Fall back to direct SGE on MR pool exhaustion Sean Rhodes <sean(a)starlabs.systems> ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: Synchronize cache for the page selector Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Fix use of completion ctx after free Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Improve admin completion context state machine Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Check stored completion CTX command ID with received one Kamal Heib <kheib(a)redhat.com> RDMA/bng_re: Fix silent failure in HWRM version query Paolo Valerio <pvalerio(a)redhat.com> net: macb: use the current queue number for stats David Carlier <devnexen(a)gmail.com> netfilter: ctnetlink: use netlink policy range checks Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: skip expectations in other netns via proc Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: revisit array resize logic Ren Wei <n05ec(a)lzu.edu.cn> netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Weiming Shi <bestswngs(a)gmail.com> netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Chuck Lever <chuck.lever(a)oracle.com> tls: Purge async_hold in tls_decrypt_async_wait() Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: clamp SCO altsetting table indices Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix not tracking outstanding TX ident Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Zhang Chen <zhangchen01(a)kylinos.cn> Bluetooth: L2CAP: Fix send LE flow credits in ACL link Miguel Ojeda <ojeda(a)kernel.org> dma-mapping: add missing `inline` for `dma_free_attrs` Jonas Köppeler <j.koeppeler(a)tu-berlin.de> net_sched: codel: fix stale state for empty flows in fq_codel Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: fix leak of SRCU struct in rtnl_link_register Thangaraj Samynathan <thangaraj.s(a)microchip.com> net: lan743x: fix duplex configuration in mac_link_up David Carlier <devnexen(a)gmail.com> net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path Jiayuan Chen <jiayuan.chen(a)shopee.com> team: fix header_ops type confusion with non-Ethernet ports Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> virtio-net: correct hdr_len handling for tunnel gso Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN Wei Fang <wei.fang(a)nxp.com> net: enetc: fix the output issue of 'ethtool --show-ring' Martin KaFai Lau <martin.lau(a)kernel.org> udp: Fix wildcard bind conflict check when using hash2 Arnd Bergmann <arnd(a)arndb.de> net: b44: always select CONFIG_FIXED_PHY Qingfang Deng <dqfext(a)gmail.com> net: airoha: add RCU lock around dev_fill_forward_path Yochai Eisenrich <echelonh(a)gmail.com> net: fix fanout UAF in packet_release() via NETDEV_UP race Kuniyuki Iwashima <kuniyu(a)google.com> ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. Kuniyuki Iwashima <kuniyu(a)google.com> ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. Kohei Enju <kohei(a)enjuk.jp> iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() Petr Oros <poros(a)redhat.com> ice: use ice_update_eth_stats() for representor stats Petr Oros <poros(a)redhat.com> ice: fix inverted ready check for VF representors David McFarland <corngood(a)gmail.com> platform/x86: intel-hid: disable wakeup_mode during hibernation Alok Tiwari <alok.a.tiwari(a)oracle.com> platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Nathan Chancellor <nathan(a)kernel.org> platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head Li RongQing <lirongqing(a)baidu.com> platform/x86: ISST: Check HWP support before MSR access Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: fix double disable of clk Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: fix double free of WoL irq Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: streamline early exit in probe Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size Qi Tang <tpluszz77(a)gmail.com> net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: validate MPLS set/set_masked payload length Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: defer tunnel netdev_put to RCU release Toke Høiland-Jørgensen <toke(a)redhat.com> net: openvswitch: Avoid releasing netdev before teardown completes Jakub Kicinski <kuba(a)kernel.org> nfc: nci: fix circular locking dependency in nci_close_device Mohammad Heib <mheib(a)redhat.com> ionic: fix persistent MAC address override on PF Luca Leonardo Scorcia <l.scorcia(a)gmail.com> pinctrl: mediatek: common: Fix probe failure for devices without EINT Helen Koike <koike(a)igalia.com> Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Anas Iqbal <mohd.abd.6602(a)gmail.com> Bluetooth: hci_ll: Fix firmware leak on error path Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Minseo Park <jacob.park.9436(a)gmail.com> Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Amelie Delaunay <amelie.delaunay(a)foss.st.com> pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC Oliver Hartkopp <socketcan(a)hartkopp.net> can: statistics: add missing atomic access in hot path Sheng Yong <shengyong1(a)xiaomi.com> erofs: set fileio bio failed in short read case Shigeru Yoshida <syoshida(a)redhat.com> dma: swiotlb: add KMSAN annotations to swiotlb_bounce() Eric Dumazet <edumazet(a)google.com> af_key: validate families in pfkey_send_migrate() Minwoo Ra <raminwo0202(a)gmail.com> xfrm: prevent policy_hthresh.work from racing with netns teardown Hyunwoo Kim <imv4bel(a)gmail.com> xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: renesas: rza1: Normalize return value of gpio_get() Neil Armstrong <neil.armstrong(a)linaro.org> pinctrl: qcom: spmi-gpio: implement .get_direction() Fernando Fernandez Mancera <fmancera(a)suse.de> xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly Felix Gu <ustc.gu(a)gmail.com> pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register() Sabrina Dubroca <sd(a)queasysnail.net> esp: fix skb leak with espintcp and async crypto Sabrina Dubroca <sd(a)queasysnail.net> xfrm: call xdo_dev_state_delete during state update Sabrina Dubroca <sd(a)queasysnail.net> xfrm: fix the condition on x->pcpu_num in xfrm_sa_len Sabrina Dubroca <sd(a)queasysnail.net> xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi Peter Yin <peteryin.openbmc(a)gmail.com> i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for ASUS UM6702RC Lianqin Hu <hulianqin(a)vivo.com> ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> spi: intel-pci: Add support for Nova Lake mobile SPI flash Jie Deng <dengjie03(a)kylinos.cn> usb: core: new quirk to handle devices with zero configurations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix gpu idle power consumption issue for gfx v12 Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: move async event work off nvmet-wq Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Handle Clang RSP musical chairs Uzair Mughal <contact(a)uzair.is-a.dev> ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone Josh Poimboeuf <jpoimboe(a)kernel.org> objtool/klp: Disable unsupported pr_debug() usage Liucheng Lu <luliucheng100(a)outlook.com> ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/ftrace: fix OOL stub count with clang HONG Yifan <elsk(a)google.com> objtool: Use HOSTCFLAGS for HAVE_XXHASH test Boris Burkov <boris(a)bur.io> btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create zhidao su <soolaugust(a)gmail.com> sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update Günther Noack <gnoack(a)google.com> HID: apple: avoid memory leak in apple_report_fixup() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Fix u32/s32 bounds when ranges cross min/max boundary Simon Trimmer <simont(a)opensource.cirrus.com> ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts Maarten Lankhorst <dev(a)lankhorst.se> drm/ttm/tests: Fix build failure on PREEMPT_RT wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/senary: Ensure EAPD is enabled during init Nilay Shroff <nilay(a)linux.ibm.com> block: break pcpu_alloc_mutex dependency on freeze_lock Isaac J. Manjarres <isaacmanjarres(a)google.com> dma-buf: Include ioctl.h in UAPI header Vladimir Yakovlev <vovchkir(a)gmail.com> spi: spi-dw-dma: fix print error log when wait finish transaction Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Sheetal <sheetal(a)nvidia.com> ALSA: hda/hdmi: Add Tegra238 HDA codec device ID Oliver Freyermuth <o.freyermuth(a)googlemail.com> ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU Florian Fuchs <fuchsfl(a)gmail.com> scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP Shuming Fan <shumingf(a)realtek.com> ASoC: rt1321: fix DMIC ch2/3 mask issue Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpi3mr: Clear reset history on ready and recheck state after timeout Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Ihor Solodrai <ihor.solodrai(a)linux.dev> module: Fix kernel panic when a symbol st_shndx is out of bounds Denis Benato <denis.benato(a)linux.dev> HID: asus: add xg mobile 2023 external hardware support Romain Sioen <romain.sioen(a)microchip.com> HID: mcp2221: cancel last I2C command on read error Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer X1 Air Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for Aokzoe A2 Pro Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> kbuild: install-extmod-build: Package resolve_btfids if necessary Valentin Spreckels <valentin(a)spreckels.dev> net: usb: r8152: add TRENDnet TUC-ET2G Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer X1z Takashi Iwai <tiwai(a)suse.de> HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer APEX Zhang Lixu <lixu.zhang(a)intel.com> HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs Victor Lattaro Volpini <victorlattaro(a)proton.me> platform/x86: hp-wmi: Add Victus 16-d0xxx support Günther Noack <gnoack(a)google.com> HID: magicmouse: avoid memory leak in magicmouse_report_fixup() Julius Lehmann <lehmanju(a)devpi.de> HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 Keith Busch <kbusch(a)kernel.org> nvme-pci: ensure we're polling a polled queue Anton Plotnikov <plotnikovanton(a)gmail.com> platform/x86: hp-wmi: add Omen 14-fb1xxx (board 8E41) support Hans de Goede <johannes.goede(a)oss.qualcomm.com> platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Leif Skunberg <diamondback(a)cohunt.app> platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support Daniel Hodges <hodgesd(a)meta.com> nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Keith Busch <kbusch(a)kernel.org> nvme-pci: cap queue creation to used queues Peter Metz <peter.metz(a)unarin.com> platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list Günther Noack <gnoack(a)google.com> HID: asus: avoid memory leak in asus_report_fixup() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support Xuewen Yan <xuewen.yan(a)unisoc.com> tracing: Revert "tracing: Remove pid in task_rename tracing output" Daniel Wade <danjwade95(a)gmail.com> bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR Jenny Guanni Qu <qguanni(a)gmail.com> bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN Ihor Solodrai <ihor.solodrai(a)linux.dev> bpf: Fix exception exit lock checking for subprogs Cui Chao <cuichao1753(a)phytium.com.cn> cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Release module BTF IDR before module unload Ian Rogers <irogers(a)google.com> perf metricgroup: Fix metricgroup__has_metric_or_groups() Danilo Krummrich <dakr(a)kernel.org> driver core: platform: use generic driver_override infrastructure Danilo Krummrich <dakr(a)kernel.org> driver core: generalize driver_override in struct device Danilo Krummrich <dakr(a)kernel.org> sh: platform_early: remove pdev->driver_override check Danilo Krummrich <dakr(a)kernel.org> hwmon: axi-fan: don't use driver_override as IRQ name Smita Koralahalli <Smita.KoralahalliChannabasappa(a)amd.com> cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled Josh Poimboeuf <jpoimboe(a)kernel.org> livepatch/klp-build: Fix inconsistent kernel version Joe Lawrence <joe.lawrence(a)redhat.com> objtool/klp: fix data alignment in __clone_symbol() Janosch Frank <frankja(a)linux.ibm.com> s390/mm: Add missing secure storage access fixups for donated memory Peter Zijlstra <peterz(a)infradead.org> perf: Make sure to use pmu_ctx->pmu for groups Peter Zijlstra <peterz(a)infradead.org> x86/perf: Make sure to program the counter value for stopped events on migration Sachin Kumar <xcyfun(a)protonmail.com> bpf: Fix constant blinding for PROBE_MEM32 stores Yazhou Tang <tangyazhou518(a)outlook.com> bpf: Reset register ID for BPF_END value tracking Davidlohr Bueso <dave(a)stgolabs.net> cxl/region: Fix leakage in __construct_region() Alison Schofield <alison.schofield(a)intel.com> cxl/port: Fix use after free of parent_port in cxl_detach_ep() ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 3 + .../devicetree/bindings/sound/st,stm32-sai.yaml | 2 +- Documentation/filesystems/overlayfs.rst | 50 +++ Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 6 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++ arch/arm64/kvm/at.c | 2 +- arch/arm64/kvm/reset.c | 14 + arch/loongarch/include/asm/linkage.h | 36 ++ arch/loongarch/include/asm/sigframe.h | 9 + arch/loongarch/kernel/asm-offsets.c | 2 + arch/loongarch/kernel/env.c | 7 +- arch/loongarch/kernel/signal.c | 6 +- arch/loongarch/kvm/intc/eiointc.c | 16 +- arch/loongarch/kvm/vcpu.c | 3 + arch/loongarch/pci/pci.c | 80 ++++ arch/loongarch/vdso/Makefile | 4 +- arch/loongarch/vdso/sigreturn.S | 6 +- arch/powerpc/net/bpf_jit_comp64.c | 23 +- arch/powerpc/tools/ftrace-gen-ool-stubs.sh | 4 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/entry.S | 3 + arch/s390/kernel/syscall.c | 5 +- arch/s390/mm/fault.c | 11 +- arch/sh/drivers/platform_early.c | 4 - arch/x86/coco/sev/noinstr.c | 6 + arch/x86/entry/entry_fred.c | 14 + arch/x86/events/core.c | 4 +- arch/x86/kernel/cpu/common.c | 20 +- arch/x86/kvm/mmu/mmu.c | 17 +- arch/x86/platform/efi/quirks.c | 2 +- block/blk-mq.c | 45 ++- drivers/accel/ivpu/ivpu_drv.h | 1 + drivers/accel/ivpu/ivpu_hw.c | 6 +- drivers/acpi/ec.c | 2 + drivers/base/bus.c | 43 ++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 +++ drivers/base/platform.c | 37 +- drivers/base/regmap/regmap.c | 30 +- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/bus/simple-pm-bus.c | 4 +- drivers/clk/imx/clk-scu.c | 3 +- drivers/cpufreq/cpufreq.c | 9 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 3 + drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/freq_table.c | 4 + drivers/cxl/core/hdm.c | 25 +- drivers/cxl/core/port.c | 8 +- drivers/cxl/core/region.c | 4 +- drivers/cxl/pmem.c | 2 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 6 +- drivers/dma/fsl-edma-main.c | 26 +- drivers/dma/idxd/cdev.c | 8 +- drivers/dma/idxd/device.c | 6 +- drivers/dma/idxd/init.c | 4 +- drivers/dma/idxd/submit.c | 2 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 ++-- drivers/dma/xilinx/xdma.c | 4 +- drivers/dma/xilinx/xilinx_dma.c | 46 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 45 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 +- .../display/dc/resource/dce100/dce100_resource.c | 6 +- .../display/dc/resource/dce110/dce110_resource.c | 5 +- .../display/dc/resource/dce112/dce112_resource.c | 5 +- .../display/dc/resource/dce120/dce120_resource.c | 5 +- .../amd/display/dc/resource/dce60/dce60_resource.c | 14 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- drivers/gpu/drm/i915/display/intel_display.c | 8 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.c | 20 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.h | 11 +- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/gpu/drm/i915/display/intel_plane.c | 11 +- drivers/gpu/drm/i915/i915_wait_util.h | 2 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 9 +- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 4 +- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 12 +- drivers/gpu/drm/xe/xe_sriov_packet.c | 2 + drivers/gpu/drm/xe/xe_vm.c | 22 +- drivers/gpu/drm/xe/xe_vm_types.h | 4 + drivers/gpu/drm/xe/xe_wa.c | 3 +- drivers/hid/hid-apple.c | 7 +- drivers/hid/hid-asus.c | 18 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 12 + drivers/hwmon/adm1177.c | 54 +-- drivers/hwmon/axi-fan-control.c | 2 +- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/ina233.c | 3 +- drivers/hwmon/pmbus/isl68137.c | 21 +- drivers/hwmon/pmbus/pmbus_core.c | 192 ++++++++-- drivers/i2c/busses/i2c-designware-amdisp.c | 11 +- drivers/i2c/busses/i2c-imx.c | 51 ++- drivers/i3c/master/dw-i3c-master.c | 2 + drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/bng_re/bng_dev.c | 14 +- drivers/infiniband/hw/efa/efa_com.c | 175 ++++----- drivers/infiniband/hw/ionic/ionic_controlpath.c | 4 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/uk.c | 39 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/irqchip/irq-renesas-rzv2h.c | 2 +- drivers/media/mc/mc-request.c | 5 + drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +- drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/net/can/dev/netlink.c | 4 +- drivers/net/ethernet/airoha/airoha_ppe.c | 2 + drivers/net/ethernet/broadcom/Kconfig | 2 +- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 66 ++-- drivers/net/ethernet/cadence/macb_main.c | 41 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 31 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 5 +- drivers/net/ethernet/microchip/lan743x_main.c | 5 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/ti/icssg/icssg_common.c | 4 +- drivers/net/team/team_core.c | 65 +++- drivers/net/tun_vnet.h | 2 +- drivers/net/usb/r8152.c | 1 + drivers/net/virtio_net.c | 7 +- drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 11 +- drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/core.c | 14 +- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/rdma.c | 1 + drivers/phy/qualcomm/phy-qcom-qmp-ufs.c | 3 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 16 + drivers/pinctrl/renesas/pinctrl-rza1.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzt2h.c | 1 + drivers/pinctrl/stm32/Kconfig | 1 + drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 12 +- drivers/platform/x86/intel/hid.c | 23 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 5 +- drivers/platform/x86/lenovo/wmi-gamezone.c | 2 - drivers/platform/x86/oxpec.c | 30 +- drivers/platform/x86/touchscreen_dmi.c | 18 + drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 + drivers/scsi/scsi_devinfo.c | 2 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-dw-dma.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-sn-f-ospi.c | 17 +- drivers/spi/spi.c | 19 +- .../int340x_thermal/processor_thermal_soc_slider.c | 8 +- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 5 + drivers/vfio/pci/vfio_pci_dmabuf.c | 5 +- drivers/virt/coco/tdx-guest/tdx-guest.c | 12 +- drivers/xen/privcmd.c | 3 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/volumes.c | 5 +- fs/erofs/fileio.c | 6 +- fs/erofs/zdata.c | 3 + fs/ext4/Makefile | 4 +- fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 6 + fs/ext4/extents.c | 23 +- fs/ext4/fast_commit.c | 17 +- fs/ext4/fsync.c | 16 +- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 10 +- fs/ext4/inode.c | 75 +++- fs/ext4/mballoc-test.c | 81 ++-- fs/ext4/mballoc.c | 132 ++++++- fs/ext4/mballoc.h | 30 ++ fs/ext4/page-io.c | 10 +- fs/ext4/super.c | 16 +- fs/ext4/sysfs.c | 10 +- fs/fs-writeback.c | 18 +- fs/fuse/file.c | 4 +- fs/fuse/inode.c | 1 + fs/iomap/buffered-io.c | 15 +- fs/jbd2/checkpoint.c | 15 +- fs/netfs/buffered_read.c | 3 +- fs/netfs/direct_read.c | 3 +- fs/netfs/direct_write.c | 15 +- fs/netfs/iterator.c | 43 +++ fs/netfs/read_collect.c | 4 +- fs/netfs/read_retry.c | 5 +- fs/netfs/read_single.c | 1 - fs/netfs/write_collect.c | 4 +- fs/netfs/write_issue.c | 3 +- fs/overlayfs/copy_up.c | 6 +- fs/overlayfs/overlayfs.h | 21 ++ fs/overlayfs/ovl_entry.h | 7 +- fs/overlayfs/params.c | 33 +- fs/overlayfs/super.c | 2 +- fs/overlayfs/util.c | 5 +- fs/smb/server/oplock.c | 72 ++-- fs/smb/server/smb2pdu.c | 73 ++-- fs/xfs/scrub/quota.c | 4 +- fs/xfs/scrub/trace.h | 12 +- fs/xfs/xfs_attr_item.c | 5 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.h | 47 ++- fs/xfs/xfs_trans_ail.c | 26 +- include/linux/damon.h | 7 + include/linux/device.h | 54 +++ include/linux/device/bus.h | 4 + include/linux/dma-mapping.h | 4 +- include/linux/fs/super_types.h | 1 + include/linux/leafops.h | 32 +- include/linux/mempolicy.h | 1 + include/linux/netfs.h | 1 - include/linux/pagemap.h | 11 - include/linux/platform_device.h | 5 - include/linux/spi/spi.h | 5 - include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/linux/virtio_net.h | 53 ++- include/net/bluetooth/l2cap.h | 2 +- include/net/codel_impl.h | 1 + include/net/inet_hashtables.h | 14 + include/net/ip6_fib.h | 21 +- include/sound/cs35l56.h | 1 + include/trace/events/netfs.h | 8 +- include/trace/events/task.h | 7 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + io_uring/fdinfo.c | 4 +- kernel/bpf/btf.c | 24 +- kernel/bpf/core.c | 43 ++- kernel/bpf/verifier.c | 36 +- kernel/dma/swiotlb.c | 21 +- kernel/events/core.c | 19 +- kernel/futex/core.c | 2 +- kernel/futex/pi.c | 3 +- kernel/futex/syscalls.c | 8 + kernel/module/main.c | 7 + kernel/power/main.c | 2 +- kernel/power/snapshot.c | 11 + kernel/sched/ext.c | 2 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_events_trigger.c | 85 ++++- kernel/trace/trace_osnoise.c | 10 +- lib/bug.c | 7 +- mm/damon/core.c | 9 +- mm/damon/stat.c | 53 ++- mm/damon/sysfs.c | 10 +- mm/memory.c | 18 +- mm/mempolicy.c | 10 +- mm/mseal.c | 3 +- mm/pagewalk.c | 25 +- net/bluetooth/l2cap_core.c | 103 +++-- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 2 +- net/bluetooth/sco.c | 10 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/isotp.c | 24 +- net/can/proc.c | 3 +- net/core/rtnetlink.c | 28 +- net/ipv4/esp4.c | 9 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6.c | 9 +- net/ipv6/ip6_fib.c | 15 +- net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 2 +- net/key/af_key.c | 19 +- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_netlink.c | 16 +- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 14 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nft_set_rbtree.c | 92 ++++- net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 11 +- net/packet/af_packet.c | 1 + net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/xfrm/xfrm_iptfs.c | 17 +- net/xfrm/xfrm_nat_keepalive.c | 2 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 7 +- rust/kernel/regulator.rs | 33 +- rust/pin-init/src/macros.rs | 16 + scripts/livepatch/klp-build | 9 +- scripts/package/install-extmod-build | 4 + sound/firewire/amdtp-stream.c | 2 +- sound/hda/codecs/hdmi/tegrahdmi.c | 1 + sound/hda/codecs/realtek/alc269.c | 42 ++- sound/hda/codecs/realtek/alc662.c | 9 + sound/hda/codecs/senarytech.c | 5 + sound/hda/controllers/intel.c | 1 - sound/soc/amd/acp/amd-acp63-acpi-match.c | 413 +++++++++++++++++++++ sound/soc/codecs/adau1372.c | 34 +- sound/soc/codecs/cs35l56-shared.c | 16 +- sound/soc/codecs/cs35l56.c | 8 + sound/soc/codecs/rt1320-sdw.c | 5 +- sound/soc/codecs/sma1307.c | 6 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/fsl/imx-card.c | 2 + sound/soc/generic/simple-card-utils.c | 4 +- sound/soc/intel/boards/sof_sdw.c | 8 + sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/samsung/i2s.c | 6 +- sound/soc/sdca/sdca_functions.c | 11 +- sound/soc/sof/ipc4-topology.c | 2 +- sound/usb/quirks.c | 4 + tools/objtool/Makefile | 2 +- tools/objtool/arch/x86/decode.c | 68 ++-- tools/objtool/check.c | 14 + tools/objtool/klp-diff.c | 26 +- tools/perf/util/metricgroup.c | 6 +- .../testing/selftests/bpf/prog_tests/reg_bounds.c | 62 +++- .../testing/selftests/bpf/progs/exceptions_fail.c | 9 +- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- 349 files changed, 3991 insertions(+), 1331 deletions(-)

1 month, 1 week

18
18
0 0

[PATCH 6.18 000/309] 6.18.21-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.21 release. There are 309 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 02 Apr 2026 16:16:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.21-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.21-rc1 Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix regressions caused by reusing ident Hao-Yu Yang <naup96721(a)gmail.com> futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() Peter Zijlstra <peterz(a)infradead.org> futex: Require sys_futex_requeue() to have identical flags Biju Das <biju.das.jz(a)bp.renesas.com> irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common() David Howells <dhowells(a)redhat.com> netfs: Fix the handling of stream->front by removing it GuoHan Zhao <zhaoguohan(a)kylinos.cn> xen/privcmd: unregister xenstore notifier on module exit Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error when running device stats on multiple devices fs Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> btrfs: fix leak of kobject name for sub-group space_info Mark Harmstone <mark(a)harmstone.com> btrfs: fix super block offset in error message in btrfs_validate_super() David Howells <dhowells(a)redhat.com> netfs: Fix read abandonment during retry Christian Brauner <brauner(a)kernel.org> selftests/mount_setattr: increase tmpfs size for idmapped mount tests Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Marek Vasut <marex(a)nabladev.com> dmaengine: xilinx: xilinx_dma: Fix dma_device directions Tuo Li <islituo(a)gmail.com> dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() Deepanshu Kartikey <kartikey406(a)gmail.com> netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry Deepanshu Kartikey <kartikey406(a)gmail.com> netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators Alexander Stein <alexander.stein(a)ew.tq-group.com> dmaengine: xilinx: xdma: Fix regmap init error handling LUO Haowen <luo-hw(a)foxmail.com> dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. Felix Gu <ustc.gu(a)gmail.com> phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix leaking event log memory Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix freeing the allocated ida too late Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix memory leak when a wq is reset Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix not releasing workqueue on .release() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix possible invalid memory access after FLR Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix crash when the event log is disabled Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm/mseal: update VMA end correctly on merge Werner Kasselman <werner(a)verivus.com> ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() Jinjiang Tu <tujinjiang(a)huawei.com> mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Josh Law <objecting(a)objecting.org> mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure SeongJae Park <sj(a)kernel.org> mm/damon/core: avoid use of half-online-committed context SeongJae Park <sj(a)kernel.org> mm/damon/stat: monitor all System RAM resources Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix amdgpu_irq enabled counter unbalanced on smu v11.0 Benno Lossin <lossin(a)kernel.org> rust: pin-init: internal: init: document load-bearing fact of field accessors Peter Zijlstra <peterz(a)infradead.org> unwind_user/x86: Fix arch=um build Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/bpf: do not increment tailcall count when prog is NULL Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off Theodore Ts'o <tytso(a)mit.edu> ext4: always drain queued discard work in ext4_mb_release() Baokun Li <libaokun(a)linux.alibaba.com> ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Theodore Ts'o <tytso(a)mit.edu> ext4: handle wraparound when searching for blocks for indirect mapped blocks Zqiang <qiang.zhang(a)linux.dev> ext4: fix the might_sleep() warnings in kvfree() Jiayuan Chen <jiayuan.chen(a)shopee.com> ext4: fix use-after-free in update_super_work when racing with umount Helen Koike <koike(a)igalia.com> ext4: reject mount if bigalloc with s_first_data_block != 0 Ye Bin <yebin10(a)huawei.com> ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Edward Adam Davis <eadavis(a)qq.com> ext4: avoid infinite loops caused by residual data Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes Ye Bin <yebin10(a)huawei.com> ext4: test if inode's all dirty pages are submitted to disk Li Chen <me(a)linux.beauty> ext4: publish jinode after initialization Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Jan Kara <jack(a)suse.cz> ext4: make recently_deleted() properly work with lazy itable initialization Jan Kara <jack(a)suse.cz> ext4: fix fsync(2) for nojournal mode Zhang Yi <yi.zhang(a)huawei.com> ext4: do not check fast symlink during orphan recovery Jan Kara <jack(a)suse.cz> ext4: fix stale xarray tags after writeback Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: convert inline data to extents when truncate exceeds inline size Simon Weber <simon.weber.39(a)gmail.com> ext4: fix journal credit check when setting fscrypt context Darrick J. Wong <djwong(a)kernel.org> xfs: remove file_path tracepoint data Darrick J. Wong <djwong(a)kernel.org> xfs: don't irele after failing to iget in xfs_attri_recover_work Long Li <leo.lilong(a)huawei.com> xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 hongao <hongao(a)uniontech.com> xfs: scrub: unlock dquot before early return in quota scrub Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: avoid dereferencing log items after push callbacks Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: save ailp before dropping the AIL lock in push callbacks Yuto Ohnuki <ytohnuki(a)amazon.com> xfs: stop reclaim before pushing AIL during unmount Max Boone <mboone(a)akamai.com> mm/pagewalk: fix race between concurrent split and refault Josh Law <objecting(a)objecting.org> mm/damon/sysfs: check contexts->nr in repeat_call_fn Josh Law <objecting(a)objecting.org> mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Asad Kamal <asad.kamal(a)amd.com> drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 Huacai Chen <chenhuacai(a)kernel.org> LoongArch: KVM: Handle the case that EIOINTC's coremap is empty Huacai Chen <chenhuacai(a)kernel.org> LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Workaround LS2K/LS7A GPU DMA hang bug Xi Ruoyao <xry111(a)xry111.site> LoongArch: vDSO: Emit GNU_EH_FRAME correctly Li Jun <lijun01(a)kylinos.cn> LoongArch: Fix missing NULL checks for kstrdup() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Unlink NV12 planes earlier Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Order OP vs. timeout correctly in __wait_for() Imre Deak <imre.deak(a)intel.com> drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state Alex Hung <alex.hung(a)amd.com> drm/amd/display: Fix drm_edid leak in amdgpu_dm Eric Huang <jinhuieric.huang(a)amd.com> drm/amdgpu: prevent immediate PASID reuse case Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock Claudiu Beznea <claudiu.beznea(a)tuxon.dev> dmaengine: sh: rz-dmac: Protect the driver specific lists Joy Zou <joy.zou(a)nxp.com> dmaengine: fsl-edma: fix channel parameter config for fixed channel requests Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: ensure no clock is generated after last read Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: fix i2c issue when reading multiple messages Davidlohr Bueso <dave(a)stgolabs.net> futex: Clear stale exiting pointer in futex_lock_pi() retry path Pratap Nirujogi <pratap.nirujogi(a)amd.com> i2c: designware: amdisp: Fix resume-probe race condition issue Jassi Brar <jassisinghbrar(a)gmail.com> irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment Milos Nikic <nikic.milos(a)gmail.com> jbd2: gracefully abort on checkpointing state corruptions Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE Kevin Hao <haokexin(a)gmail.com> net: macb: Use dev_consume_skb_any() to free TX SKBs Kevin Hao <haokexin(a)gmail.com> net: macb: Protect access to net_device::ip_ptr with RCU lock Kevin Hao <haokexin(a)gmail.com> net: macb: Move devm_{free,request}_irq() out of spin lock area Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: ses: Handle positive SCSI error from ses_recv_diag() Tyllis Xu <livelycarpet87(a)gmail.com> scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Amir Goldstein <amir73il(a)gmail.com> ovl: fix wrong detection of 32bit inode numbers Fei Lv <feilv(a)asrmicro.com> ovl: make fsync after metadata copy-up opt-in mount option Abel Vesa <abel.vesa(a)oss.qualcomm.com> phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 Nikunj A Dadhania <nikunj(a)amd.com> x86/fred: Fix early boot failures on SEV-ES/SNP guests Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask Nikunj A Dadhania <nikunj(a)amd.com> x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Joanne Koong <joannelkoong(a)gmail.com> writeback: don't block sync for filesystems with no data integrity guarantees Zhan Xusheng <zhanxusheng1024(a)gmail.com> alarmtimer: Fix argument order in alarm_timer_forward() Jiucheng Xu <jiucheng.xu(a)amlogic.com> erofs: add GFP_NOIO in the bio completion if needed xietangxin <xietangxin(a)yeah.net> virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Zubin Mithra <zsm(a)google.com> virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Paul Moses <p(a)1g4.org> xfrm: iptfs: only publish mode_data after clone setup Roshan Kumar <roshaen09(a)gmail.com> xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Yuchan Nam <entropy1110(a)gmail.com> media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() Sanman Pradhan <psanman(a)juniper.net> hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes Sanman Pradhan <psanman(a)juniper.net> hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read Marc Zyngier <maz(a)kernel.org> KVM: arm64: Discard PC update state on vcpu reset Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Correct locked bit width Abhijit Gangurde <abhijit.gangurde(a)amd.com> RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> thermal: intel: int340x: soc_slider: Set offset only for balanced mode Charles Mirabile <cmirabil(a)redhat.com> kbuild: Delete .builtin-dtbs.S when running make clean Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: conservative: Reset requested_freq on limits change Marc Kleine-Budde <mkl(a)pengutronix.de> can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix tx.buf use-after-free in isotp_sendmsg() Ali Norouzi <ali.norouzi(a)keysight.com> can: gw: fix OOB heap access in cgw_csum_crc8_rel() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload Guangshuo Li <lgs201920130244(a)gmail.com> ASoC: sma1307: fix double free of devm_kzalloc() memory Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: codecs: wcd934x: fix typo in dt parsing Alexey Nepomnyashih <sdl(a)nppct.ru> ALSA: firewire-lib: fix uninitialized local variable Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR Mario Limonciello <mario.limonciello(a)amd.com> Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist" Hyunwoo Kim <imv4bel(a)gmail.com> ksmbd: do not expire session on binding failure Werner Kasselman <werner(a)verivus.com> ksmbd: fix memory leaks and NULL deref in smb2_lock() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix potencial OOB in get_file_all_info() for compound requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() Matthew Auld <matthew.auld(a)intel.com> drm/xe: always keep track of remap prev/next Luo Haiyang <luo.haiyang(a)zte.com.cn> tracing: Fix potential deadlock in cpu hotplug with osnoise Vasily Gorbik <gor(a)linux.ibm.com> s390/entry: Scrub r12 register on kernel entry Vasily Gorbik <gor(a)linux.ibm.com> s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> s390/syscalls: Add spectre boundary for syscall dispatch table Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP Marc Kleine-Budde <mkl(a)pengutronix.de> spi: spi-fsl-lpspi: fix teardown order issue (UAF) Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix clock leak on PLL lock failure Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: adau1372: Fix unchecked clk_prepare_enable() return value Marc Buerg <buermarc(a)googlemail.com> sysctl: fix uninitialized variable in proc_do_large_bitmap Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/core) Protect regulator operations with mutex Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Introduce the concept of "write-only" attributes Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only Sanman Pradhan <psanman(a)juniper.net> hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib Weiming Shi <bestswngs(a)gmail.com> ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Danilo Krummrich <dakr(a)kernel.org> spi: use generic driver_override infrastructure Matt Roper <matthew.d.roper(a)intel.com> drm/xe: Implement recent spec updates to Wa_16025250150 Alice Ryhl <aliceryhl(a)google.com> rust: regulator: do not assume that regulator_get() returns non-null Jihed Chaibi <jihed.chaibi.dev(a)gmail.com> ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: catpt: Fix the device initialization Felix Gu <ustc.gu(a)gmail.com> spi: sn-f-ospi: Fix resource leak in f_ospi_probe() Youngjun Park <youngjun.park(a)lge.com> PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() Alberto Garcia <berto(a)igalia.com> PM: hibernate: Drain trailing zero pages on userspace restore Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Luca Leonardo Scorcia <l.scorcia(a)gmail.com> drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register Mike Rapoport (Microsoft) <rppt(a)kernel.org> x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Yihang Li <liyihang9(a)huawei.com> scsi: scsi_transport_sas: Fix the maximum channel scanning issue Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl: imx-card: initialize playback_only and capture_only Shiraz Saleem <shiraz.saleem(a)intel.com> RDMA/irdma: Harden depth calculation functions Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Return EINVAL for invalid arp index error Anil Samal <anil.samal(a)intel.com> RDMA/irdma: Fix deadlock during netdev reset with active connections Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() Ivan Barrera <ivan.d.barrera(a)intel.com> RDMA/irdma: Clean up unnecessary dereference of event->cm_node Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() Tatyana Nikolova <tatyana.e.nikolova(a)intel.com> RDMA/irdma: Update ibqp state to error if QP is already in error state Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Initialize free_qp completion before using it Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP Ethan Tidmore <ethantidmore06(a)gmail.com> RDMA/efa: Fix possible deadlock Chuck Lever <chuck.lever(a)oracle.com> RDMA/rw: Fall back to direct SGE on MR pool exhaustion Sean Rhodes <sean(a)starlabs.systems> ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> regmap: Synchronize cache for the page selector Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Fix use of completion ctx after free Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Improve admin completion context state machine Yonatan Nachum <ynachum(a)amazon.com> RDMA/efa: Check stored completion CTX command ID with received one Paolo Valerio <pvalerio(a)redhat.com> net: macb: use the current queue number for stats David Carlier <devnexen(a)gmail.com> netfilter: ctnetlink: use netlink policy range checks Weiming Shi <bestswngs(a)gmail.com> netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: skip expectations in other netns via proc Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: revisit array resize logic Ren Wei <n05ec(a)lzu.edu.cn> netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Weiming Shi <bestswngs(a)gmail.com> netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Chuck Lever <chuck.lever(a)oracle.com> tls: Purge async_hold in tls_decrypt_async_wait() Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: clamp SCO altsetting table indices Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix not tracking outstanding TX ident Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Zhang Chen <zhangchen01(a)kylinos.cn> Bluetooth: L2CAP: Fix send LE flow credits in ACL link Miguel Ojeda <ojeda(a)kernel.org> dma-mapping: add missing `inline` for `dma_free_attrs` Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: fix leak of SRCU struct in rtnl_link_register Thangaraj Samynathan <thangaraj.s(a)microchip.com> net: lan743x: fix duplex configuration in mac_link_up Jiayuan Chen <jiayuan.chen(a)shopee.com> team: fix header_ops type confusion with non-Ethernet ports Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> virtio-net: correct hdr_len handling for tunnel gso Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN Wei Fang <wei.fang(a)nxp.com> net: enetc: fix the output issue of 'ethtool --show-ring' Martin KaFai Lau <martin.lau(a)kernel.org> udp: Fix wildcard bind conflict check when using hash2 Qingfang Deng <dqfext(a)gmail.com> net: airoha: add RCU lock around dev_fill_forward_path Yochai Eisenrich <echelonh(a)gmail.com> net: fix fanout UAF in packet_release() via NETDEV_UP race Kuniyuki Iwashima <kuniyu(a)google.com> ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. Kuniyuki Iwashima <kuniyu(a)google.com> ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. Kohei Enju <kohei(a)enjuk.jp> iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() Petr Oros <poros(a)redhat.com> ice: use ice_update_eth_stats() for representor stats Petr Oros <poros(a)redhat.com> ice: fix inverted ready check for VF representors David McFarland <corngood(a)gmail.com> platform/x86: intel-hid: disable wakeup_mode during hibernation Alok Tiwari <alok.a.tiwari(a)oracle.com> platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Nathan Chancellor <nathan(a)kernel.org> platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head Li RongQing <lirongqing(a)baidu.com> platform/x86: ISST: Check HWP support before MSR access Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: fix double disable of clk Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: fix double free of WoL irq Justin Chen <justin.chen(a)broadcom.com> net: bcmasp: streamline early exit in probe Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Sabrina Dubroca <sd(a)queasysnail.net> rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size Qi Tang <tpluszz77(a)gmail.com> net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: validate MPLS set/set_masked payload length Yang Yang <n05ec(a)lzu.edu.cn> openvswitch: defer tunnel netdev_put to RCU release Toke Høiland-Jørgensen <toke(a)redhat.com> net: openvswitch: Avoid releasing netdev before teardown completes Jakub Kicinski <kuba(a)kernel.org> nfc: nci: fix circular locking dependency in nci_close_device Mohammad Heib <mheib(a)redhat.com> ionic: fix persistent MAC address override on PF Luca Leonardo Scorcia <l.scorcia(a)gmail.com> pinctrl: mediatek: common: Fix probe failure for devices without EINT Helen Koike <koike(a)igalia.com> Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Anas Iqbal <mohd.abd.6602(a)gmail.com> Bluetooth: hci_ll: Fix firmware leak on error path Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Minseo Park <jacob.park.9436(a)gmail.com> Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Amelie Delaunay <amelie.delaunay(a)foss.st.com> pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC Oliver Hartkopp <socketcan(a)hartkopp.net> can: statistics: add missing atomic access in hot path Sheng Yong <shengyong1(a)xiaomi.com> erofs: set fileio bio failed in short read case Shigeru Yoshida <syoshida(a)redhat.com> dma: swiotlb: add KMSAN annotations to swiotlb_bounce() Eric Dumazet <edumazet(a)google.com> af_key: validate families in pfkey_send_migrate() Minwoo Ra <raminwo0202(a)gmail.com> xfrm: prevent policy_hthresh.work from racing with netns teardown Hyunwoo Kim <imv4bel(a)gmail.com> xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: renesas: rza1: Normalize return value of gpio_get() Fernando Fernandez Mancera <fmancera(a)suse.de> xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly Felix Gu <ustc.gu(a)gmail.com> pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register() Sabrina Dubroca <sd(a)queasysnail.net> esp: fix skb leak with espintcp and async crypto Sabrina Dubroca <sd(a)queasysnail.net> xfrm: call xdo_dev_state_delete during state update Sabrina Dubroca <sd(a)queasysnail.net> xfrm: fix the condition on x->pcpu_num in xfrm_sa_len Sabrina Dubroca <sd(a)queasysnail.net> xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi Peter Yin <peteryin.openbmc(a)gmail.com> i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for ASUS UM6702RC Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> spi: intel-pci: Add support for Nova Lake mobile SPI flash Jie Deng <dengjie03(a)kylinos.cn> usb: core: new quirk to handle devices with zero configurations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix gpu idle power consumption issue for gfx v12 Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: move async event work off nvmet-wq Josh Poimboeuf <jpoimboe(a)kernel.org> objtool: Handle Clang RSP musical chairs Uzair Mughal <contact(a)uzair.is-a.dev> ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone Liucheng Lu <luliucheng100(a)outlook.com> ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk Hari Bathini <hbathini(a)linux.ibm.com> powerpc64/ftrace: fix OOL stub count with clang Boris Burkov <boris(a)bur.io> btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create zhidao su <soolaugust(a)gmail.com> sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update Günther Noack <gnoack(a)google.com> HID: apple: avoid memory leak in apple_report_fixup() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Fix u32/s32 bounds when ranges cross min/max boundary Simon Trimmer <simont(a)opensource.cirrus.com> ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts Maarten Lankhorst <dev(a)lankhorst.se> drm/ttm/tests: Fix build failure on PREEMPT_RT wangdicheng <wangdicheng(a)kylinos.cn> ALSA: hda/senary: Ensure EAPD is enabled during init Nilay Shroff <nilay(a)linux.ibm.com> block: break pcpu_alloc_mutex dependency on freeze_lock Isaac J. Manjarres <isaacmanjarres(a)google.com> dma-buf: Include ioctl.h in UAPI header Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Sheetal <sheetal(a)nvidia.com> ALSA: hda/hdmi: Add Tegra238 HDA codec device ID Oliver Freyermuth <o.freyermuth(a)googlemail.com> ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU Florian Fuchs <fuchsfl(a)gmail.com> scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP Shuming Fan <shumingf(a)realtek.com> ASoC: rt1321: fix DMIC ch2/3 mask issue Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpi3mr: Clear reset history on ready and recheck state after timeout Mark Brown <broonie(a)kernel.org> ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Ihor Solodrai <ihor.solodrai(a)linux.dev> module: Fix kernel panic when a symbol st_shndx is out of bounds Denis Benato <denis.benato(a)linux.dev> HID: asus: add xg mobile 2023 external hardware support Romain Sioen <romain.sioen(a)microchip.com> HID: mcp2221: cancel last I2C command on read error Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer X1 Air Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for Aokzoe A2 Pro Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> kbuild: install-extmod-build: Package resolve_btfids if necessary Valentin Spreckels <valentin(a)spreckels.dev> net: usb: r8152: add TRENDnet TUC-ET2G Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer X1z Takashi Iwai <tiwai(a)suse.de> HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list Antheas Kapenekakis <lkml(a)antheas.dev> platform/x86: oxpec: Add support for OneXPlayer APEX Zhang Lixu <lixu.zhang(a)intel.com> HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs Günther Noack <gnoack(a)google.com> HID: magicmouse: avoid memory leak in magicmouse_report_fixup() Julius Lehmann <lehmanju(a)devpi.de> HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 Keith Busch <kbusch(a)kernel.org> nvme-pci: ensure we're polling a polled queue Hans de Goede <johannes.goede(a)oss.qualcomm.com> platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Leif Skunberg <diamondback(a)cohunt.app> platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support Daniel Hodges <hodgesd(a)meta.com> nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Keith Busch <kbusch(a)kernel.org> nvme-pci: cap queue creation to used queues Peter Metz <peter.metz(a)unarin.com> platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list Günther Noack <gnoack(a)google.com> HID: asus: avoid memory leak in asus_report_fixup() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support Xuewen Yan <xuewen.yan(a)unisoc.com> tracing: Revert "tracing: Remove pid in task_rename tracing output" Daniel Wade <danjwade95(a)gmail.com> bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR Jenny Guanni Qu <qguanni(a)gmail.com> bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN Ihor Solodrai <ihor.solodrai(a)linux.dev> bpf: Fix exception exit lock checking for subprogs Cui Chao <cuichao1753(a)phytium.com.cn> cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Release module BTF IDR before module unload Danilo Krummrich <dakr(a)kernel.org> driver core: platform: use generic driver_override infrastructure Danilo Krummrich <dakr(a)kernel.org> driver core: generalize driver_override in struct device Danilo Krummrich <dakr(a)kernel.org> sh: platform_early: remove pdev->driver_override check Danilo Krummrich <dakr(a)kernel.org> hwmon: axi-fan: don't use driver_override as IRQ name Smita Koralahalli <Smita.KoralahalliChannabasappa(a)amd.com> cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled Janosch Frank <frankja(a)linux.ibm.com> s390/mm: Add missing secure storage access fixups for donated memory Peter Zijlstra <peterz(a)infradead.org> perf: Make sure to use pmu_ctx->pmu for groups Peter Zijlstra <peterz(a)infradead.org> x86/perf: Make sure to program the counter value for stopped events on migration Sachin Kumar <xcyfun(a)protonmail.com> bpf: Fix constant blinding for PROBE_MEM32 stores Yazhou Tang <tangyazhou518(a)outlook.com> bpf: Reset register ID for BPF_END value tracking Alison Schofield <alison.schofield(a)intel.com> cxl/port: Fix use after free of parent_port in cxl_detach_ep() ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 3 + .../devicetree/bindings/sound/st,stm32-sai.yaml | 2 +- Documentation/filesystems/overlayfs.rst | 50 +++ Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 6 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++ arch/arm64/kvm/reset.c | 14 + arch/loongarch/include/asm/linkage.h | 36 ++ arch/loongarch/include/asm/sigframe.h | 9 + arch/loongarch/kernel/asm-offsets.c | 2 + arch/loongarch/kernel/env.c | 7 +- arch/loongarch/kernel/signal.c | 6 +- arch/loongarch/kvm/intc/eiointc.c | 2 +- arch/loongarch/kvm/vcpu.c | 3 + arch/loongarch/pci/pci.c | 80 ++++ arch/loongarch/vdso/Makefile | 4 +- arch/loongarch/vdso/sigreturn.S | 6 +- arch/powerpc/net/bpf_jit_comp64.c | 23 +- arch/powerpc/tools/ftrace-gen-ool-stubs.sh | 4 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/entry.S | 3 + arch/s390/kernel/syscall.c | 5 +- arch/s390/mm/fault.c | 11 +- arch/sh/drivers/platform_early.c | 4 - arch/x86/coco/sev/noinstr.c | 6 + arch/x86/entry/entry_fred.c | 14 + arch/x86/events/core.c | 4 +- arch/x86/include/asm/unwind_user.h | 4 + arch/x86/kernel/cpu/common.c | 20 +- arch/x86/kvm/mmu/mmu.c | 17 +- arch/x86/platform/efi/quirks.c | 2 +- block/blk-mq.c | 45 ++- drivers/acpi/ec.c | 2 + drivers/base/bus.c | 43 ++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 +++ drivers/base/platform.c | 37 +- drivers/base/regmap/regmap.c | 30 +- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/bus/simple-pm-bus.c | 4 +- drivers/clk/imx/clk-scu.c | 3 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 3 + drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cxl/core/hdm.c | 25 +- drivers/cxl/core/port.c | 8 +- drivers/cxl/pmem.c | 2 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 6 +- drivers/dma/fsl-edma-main.c | 26 +- drivers/dma/idxd/cdev.c | 8 +- drivers/dma/idxd/device.c | 6 +- drivers/dma/idxd/init.c | 4 +- drivers/dma/idxd/submit.c | 2 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 ++-- drivers/dma/xilinx/xdma.c | 4 +- drivers/dma/xilinx/xilinx_dma.c | 46 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 45 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- drivers/gpu/drm/i915/display/intel_display.c | 8 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.c | 20 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.h | 11 +- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/gpu/drm/i915/display/intel_plane.c | 11 +- drivers/gpu/drm/i915/i915_wait_util.h | 2 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 9 +- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 4 +- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 12 +- drivers/gpu/drm/xe/xe_vm.c | 22 +- drivers/gpu/drm/xe/xe_vm_types.h | 4 + drivers/gpu/drm/xe/xe_wa.c | 3 +- drivers/hid/hid-apple.c | 7 +- drivers/hid/hid-asus.c | 18 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 12 + drivers/hwmon/adm1177.c | 54 +-- drivers/hwmon/axi-fan-control.c | 2 +- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/ina233.c | 3 +- drivers/hwmon/pmbus/isl68137.c | 21 +- drivers/hwmon/pmbus/pmbus_core.c | 192 ++++++++-- drivers/i2c/busses/i2c-designware-amdisp.c | 11 +- drivers/i2c/busses/i2c-imx.c | 51 ++- drivers/i3c/master/dw-i3c-master.c | 2 + drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/efa/efa_com.c | 175 ++++----- drivers/infiniband/hw/ionic/ionic_controlpath.c | 4 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/uk.c | 39 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/irqchip/irq-renesas-rzv2h.c | 2 +- drivers/media/mc/mc-request.c | 5 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/net/can/dev/netlink.c | 4 +- drivers/net/ethernet/airoha/airoha_ppe.c | 2 + drivers/net/ethernet/broadcom/asp2/bcmasp.c | 66 ++-- drivers/net/ethernet/cadence/macb_main.c | 41 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 31 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 5 +- drivers/net/ethernet/microchip/lan743x_main.c | 5 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/team/team_core.c | 65 +++- drivers/net/tun_vnet.h | 2 +- drivers/net/usb/r8152.c | 1 + drivers/net/virtio_net.c | 7 +- drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 11 +- drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/core.c | 14 +- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/rdma.c | 1 + drivers/phy/qualcomm/phy-qcom-qmp-ufs.c | 3 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/pinctrl/renesas/pinctrl-rza1.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzt2h.c | 1 + drivers/pinctrl/stm32/Kconfig | 1 + drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 8 + drivers/platform/x86/intel/hid.c | 23 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 5 +- drivers/platform/x86/lenovo/wmi-gamezone.c | 2 - drivers/platform/x86/oxpec.c | 30 +- drivers/platform/x86/touchscreen_dmi.c | 18 + drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 + drivers/scsi/scsi_devinfo.c | 2 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-sn-f-ospi.c | 17 +- drivers/spi/spi.c | 19 +- .../int340x_thermal/processor_thermal_soc_slider.c | 8 +- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 5 + drivers/virt/coco/tdx-guest/tdx-guest.c | 12 +- drivers/xen/privcmd.c | 3 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/volumes.c | 5 +- fs/erofs/fileio.c | 6 +- fs/erofs/zdata.c | 3 + fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 23 +- fs/ext4/fast_commit.c | 17 +- fs/ext4/fsync.c | 16 +- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 10 +- fs/ext4/inode.c | 75 +++- fs/ext4/mballoc.c | 30 +- fs/ext4/page-io.c | 10 +- fs/ext4/super.c | 16 +- fs/ext4/sysfs.c | 10 +- fs/fs-writeback.c | 18 +- fs/fuse/file.c | 4 +- fs/fuse/inode.c | 1 + fs/jbd2/checkpoint.c | 15 +- fs/netfs/buffered_read.c | 3 +- fs/netfs/direct_read.c | 3 +- fs/netfs/direct_write.c | 15 +- fs/netfs/iterator.c | 43 +++ fs/netfs/read_collect.c | 4 +- fs/netfs/read_retry.c | 5 +- fs/netfs/read_single.c | 1 - fs/netfs/write_collect.c | 4 +- fs/netfs/write_issue.c | 3 +- fs/overlayfs/copy_up.c | 6 +- fs/overlayfs/overlayfs.h | 21 ++ fs/overlayfs/ovl_entry.h | 7 +- fs/overlayfs/params.c | 33 +- fs/overlayfs/super.c | 2 +- fs/overlayfs/util.c | 5 +- fs/smb/server/oplock.c | 72 ++-- fs/smb/server/smb2pdu.c | 73 ++-- fs/xfs/scrub/quota.c | 4 +- fs/xfs/scrub/trace.h | 12 +- fs/xfs/xfs_attr_item.c | 5 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.h | 47 ++- fs/xfs/xfs_trans_ail.c | 26 +- include/linux/damon.h | 6 + include/linux/device.h | 54 +++ include/linux/device/bus.h | 4 + include/linux/dma-mapping.h | 4 +- include/linux/fs.h | 1 + include/linux/mempolicy.h | 1 + include/linux/netfs.h | 1 - include/linux/pagemap.h | 11 - include/linux/platform_device.h | 5 - include/linux/spi/spi.h | 5 - include/linux/swapops.h | 27 +- include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/linux/virtio_net.h | 53 ++- include/net/bluetooth/l2cap.h | 2 +- include/net/inet_hashtables.h | 14 + include/net/ip6_fib.h | 21 +- include/sound/cs35l56.h | 1 + include/trace/events/netfs.h | 8 +- include/trace/events/task.h | 7 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + kernel/bpf/btf.c | 24 +- kernel/bpf/core.c | 43 ++- kernel/bpf/verifier.c | 36 +- kernel/dma/swiotlb.c | 21 +- kernel/events/core.c | 19 +- kernel/futex/core.c | 2 +- kernel/futex/pi.c | 3 +- kernel/futex/syscalls.c | 8 + kernel/module/main.c | 7 + kernel/power/main.c | 2 +- kernel/power/snapshot.c | 11 + kernel/sched/ext.c | 2 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_osnoise.c | 10 +- mm/damon/core.c | 8 + mm/damon/stat.c | 36 +- mm/damon/sysfs.c | 10 +- mm/mempolicy.c | 10 +- mm/mseal.c | 5 +- mm/pagewalk.c | 25 +- net/bluetooth/l2cap_core.c | 103 +++-- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 2 +- net/bluetooth/sco.c | 10 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/isotp.c | 24 +- net/can/proc.c | 3 +- net/core/rtnetlink.c | 28 +- net/ipv4/esp4.c | 9 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6.c | 9 +- net/ipv6/ip6_fib.c | 15 +- net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 2 +- net/key/af_key.c | 19 +- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_netlink.c | 16 +- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 14 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nft_set_rbtree.c | 92 ++++- net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 11 +- net/packet/af_packet.c | 1 + net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/xfrm/xfrm_iptfs.c | 17 +- net/xfrm/xfrm_nat_keepalive.c | 2 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 7 +- rust/kernel/regulator.rs | 33 +- rust/pin-init/src/macros.rs | 16 + scripts/package/install-extmod-build | 4 + sound/firewire/amdtp-stream.c | 2 +- sound/hda/codecs/hdmi/tegrahdmi.c | 1 + sound/hda/codecs/realtek/alc269.c | 42 ++- sound/hda/codecs/realtek/alc662.c | 9 + sound/hda/codecs/senarytech.c | 5 + sound/hda/controllers/intel.c | 1 - sound/soc/amd/acp/amd-acp63-acpi-match.c | 413 +++++++++++++++++++++ sound/soc/codecs/adau1372.c | 34 +- sound/soc/codecs/cs35l56-shared.c | 16 +- sound/soc/codecs/cs35l56.c | 8 + sound/soc/codecs/rt1320-sdw.c | 5 +- sound/soc/codecs/sma1307.c | 6 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/fsl/imx-card.c | 2 + sound/soc/intel/boards/sof_sdw.c | 8 + sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/samsung/i2s.c | 6 +- sound/soc/sof/ipc4-topology.c | 2 +- sound/usb/quirks.c | 2 + tools/objtool/arch/x86/decode.c | 68 ++-- tools/objtool/check.c | 14 + .../testing/selftests/bpf/prog_tests/reg_bounds.c | 62 +++- .../testing/selftests/bpf/progs/exceptions_fail.c | 9 +- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- 316 files changed, 3581 insertions(+), 1178 deletions(-)

1 month, 1 week

14
13
0 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage