Lkft-triage August 2026

lkft-triage@lists.linaro.org

33 participants
33 discussions

by 石嶋紗季

　新しい事業をお考えの方向けに、　日本の将来を担う、こども教育にたずさわる事業の　パートナー募集説明会(オンライン)を　ご視聴頂きたく、ご連絡いたしました。　　本事業は9割以上、異業種から新規参入されており　「未経験」「社員1名」でスタート可能です。　　本業はそのままで、収益づくりをお考えの方はぜひご視聴ください。　 ----------------------------------------------------------- 　　　不況に強く、少子化でも成長する　　　プログラミング教育×個別指導　― 地域に"初"のハイブリッド型学習塾を ― 　　日時：8月20日（木）13：00〜14：00 　形式：オンライン開催　提供：エイチ・エム・グループ　　　　　　＜ご視聴はこちら＞　　　　https://wam-edu-fc.jp/wam2/ ----------------------------------------------------------- 　　　『少子化なのに、教育事業？』と、思うかもしれませんが　　実は、教育無償化などの国策もあり、子ども一人にかける　教育費の増加に伴い、市場は成長し続けています。　　また、教育費は不況時でも削減されにくいため　コロナ下でも大きく落ち込むことなく底堅さを見せました。　　そんな教育業界の中でも、プログラミング（IT教育）は　小学校で必修化されたため、保護者の関心が非常に高まっています。　　　そこで今回ご紹介するのが、全国300校舎、継続率97.6％を誇る　ハイブリッド教育事業「個別指導WAM」です。　　サイバーエージェント社開発の教材を活用した　「プログラミング×個別指導」という　他塾にはない独自の教育事業を提供しています。　いったい、教育市場にどのようなビジネスチャンスがあるのか？　オンラインセミナーで分かりやすく丁寧に　お伝えしますので、ぜひご視聴ください。　　　　　　　＜ご視聴はこちら＞　　　　https://wam-edu-fc.jp/wam2/ 　　 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 　教育事業FCセミナー事務局　電話：0120-889-859 　住所：東京都中央区銀座7-13-6 ――――――――――――――――――――――――――――――― 　本メールのご不要な方には大変ご迷惑をおかけいたしました。　今後ご案内が不要な方は下記URLよりお手続きをお願いいたします。　┗　https://wam-edu-fc.jp/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1 week

Explore Cutting-Edge IoT Solutions Tailored to Your Needs

by Kori

Greetings Lkft-Triage, Hope this email finds you well. I’m Kori from WidelOT In Xiamen, we provide comprehensive IIoT hardware and cloud solutions tailored for factory automation, energy, and equipment manufacturers. Our main items: ‑ 4G/5G Industrial Routers / Gateways / Edge Computers ‑ Industrial Ethernet Switches ‑ I/O Modules & IoT Cloud Platform Our sales director will pay a business visit to your market shortly. We are currently seeking qualified local agents and distributors to establish long-term partnerships. If you are accessible to become our local partner, kindly reply. I will send you our agent agreements Additionally, we can arrange an on-site meeting to discuss the product catalog. Looking forward to hearing from you. Best regards Kori kori(a)widelot.com www.wideiot.com Hit subscribe now to receive regular updates and our product’s latest features! Subscribe If you don't want to receive our emails, you can easily unsubscribe here. Kori Ke kori(a)wideiot.com 签名由网易企业邮箱定制

1 week, 5 days

Lists - Payment Advice

by lists.linaro.org Client Portal

DOC SWIFT_PAYMENT_MT103_01.pdf 672 KB ▼ DOC SWIFT_PAYMENT_MT103_02.pdf 629 KB ▼   DOC SWIFT_PAYMENT_MT103_03.pdf 615 KB ▼ DOC SWIFT_PAYMENT_MT103_04.pdf 655 KB ▼     ↑ 6 attachments (2.5 MB)   ▼ Download all Payment Notification Good day, Please be notified we have made payment for due invoices. Please Download the attached SWIFT COPIES. Thanks Accounts Department.

1 week, 6 days

[PATCH 7.1 000/438] 7.1.8-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.8 release. There are 438 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.8-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.8-rc1 Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Matthew Brost <matthew.brost(a)intel.com> drm/xe: Set TTM device beneficial_order to 9 (2M) Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Separate early xe_device initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.devid|revid initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.force_execlist initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Drop unused param from xe_device_create() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Alan Swanson <reiver(a)improbability.net> drm/amd/display: Silence link_dpms I2C retimer failures Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames George Zhang <george.zhang(a)amd.com> drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: check if dml21_add_phantom_plane() is successful Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: use milliwatts for GPU power sensors Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: hide pp_table sysfs on APUs Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Guangshuo Li <lgs201920130244(a)gmail.com> drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Close speculative mem read possibility Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Sasha Finkelstein <k(a)chaosmail.tech> power: supply: macsmc: Support macOS 27 SMC firmware Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Christian Loehle <christian.loehle(a)arm.com> cpufreq: cppc: Sanitize lockless policy limit snapshots Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Daniel Golle <daniel(a)makrotopia.org> gpiolib: tolerate gpio-hogs lacking a hogging state Hardik Prakash <hardikprakash.official(a)gmail.com> i2c: designware: defer probe if child GpioInt controllers are not bound Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Shawn Guo <shengchao.guo(a)oss.qualcomm.com> scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <dlemoal(a)kernel.org> scsi: libsas: terminate deferred commands on time out Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Jiakai Xu <xujiakai2025(a)iscas.ac.cn> riscv/mm: use physical alignment for vmemmap_start_pfn Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kyumin Lee <fyonglkm(a)gmail.com> io_uring: preserve task restrictions across exec Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: fix tid_tx use-after-free on BA session stop Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Soeren Moch <smoch(a)web.de> PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> fou: Fix use-after-free in fou_create() Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: schedule deferred atapi command Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Usama Arif <usama.arif(a)linux.dev> userfaultfd: wait on source PMD during UFFDIO_MOVE Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Stanislav Kinsburskii <skinsburskii(a)gmail.com> lib: test_hmm: use device devt for coherent device range selection Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Mykola Lysenko <nickolay.lysenko(a)gmail.com> btrfs: raid56: fix scrub read assembly submitting no reads Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Qi Zheng <qi.zheng(a)linux.dev> mm: mglru: fix stale batch updates after memcg reparenting Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Check all controls for fast switching Nicolas Schier <n.schier(a)fritz.com> kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Reject DMABUF pages from the access pin path Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Publish VP to pt_vp_array before installing the file descriptor Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix missing error code on VP allocation failure Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use memcmp() to compare ClientGUIDs Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: Return error code from mana_create_rxq() Long Li <longli(a)microsoft.com> net: mana: Create separate EQs for each vPort Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: Fix E2E delay mechanism Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> riscv: vdso: Only try to install vDSO when present Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> ipv6: release fib6_null_entry on subtree failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix reader page read offset for remote buffers Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/pt: check no-DMA huge-pte cases before DMA segment test Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Ao Sun <ao.sun(a)transsion.com> scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Block VFs from clobbering special CGX PKIND state Ratheesh Kannoth <rkannoth(a)marvell.com> octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_past_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Michael Bommarito <michael.bommarito(a)gmail.com> idpf: bound interrupt-vector register fill to the allocated array Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller David Howells <dhowells(a)redhat.com> netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Eric Joyner <eric.joyner(a)amd.com> ethtool: Embed FEC hist ranges as buffer in struct Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove Surendra Singh Chouhan <kr494167(a)gmail.com> ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Skip writes to unsupported performance controls Alex Tran <alex.tran(a)oss.qualcomm.com> gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper Gao Xiang <xiang(a)kernel.org> erofs: ensure valid f_path for page cache sharing Gao Xiang <xiang(a)kernel.org> erofs: remove fscache backend entirely Gao Xiang <xiang(a)kernel.org> erofs: clean up erofs_ishare_fill_inode() Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jonas Köppeler <j.koeppeler(a)tu-berlin.de> net/sched: sch_cake: skip clearing unused tins during rate adjustment Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: reclaim invalid Tx descriptors in ZC batch path Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: provide sufficient space in pool->tx_descs Jason Xing <kerneljasonxing(a)gmail.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kerneljasonxing(a)gmail.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: take nh->lock for f6i_list walks in replace check and notify Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Make UMP message size check more robust Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Always free firmware in FDL path Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Correct pointer passed to devm_acpi_table_put Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: clear the nfct flag under lock Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Julian Anastasov <ja(a)ssi.bg> ipvs: adjust double hashing when fwd method changes Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Add missing hyp_enter when trapping sysreg Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace clock disabling Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Mitigate potential LPI registration failure Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Fix race between LPI release and re-registration Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Yi Xie <xieyi(a)kylinos.cn> mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() Lorenzo Bianconi <lorenzo(a)kernel.org> selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Tomas Glozar <tglozar(a)redhat.com> rtla/timerlat_top: Fix on-threshold actions firing on signal Namjae Jeon <linkinjeon(a)kernel.org> ntfs: drop stale page-cache when shrinking a non-resident attr Namjae Jeon <linkinjeon(a)kernel.org> ntfs: harden runlist realloc size calculations Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: skip fully truncated ordered extents at zone finish Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Dongjiang Zhu <zhudongjiang(a)fnnas.com> btrfs: skip global block reserve accounting for rescue mounts Qu Wenruo <wqu(a)suse.com> btrfs: warn about extent buffer that can not be released Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Namjae Jeon <linkinjeon(a)kernel.org> ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix double free of wq, engine, and group structs Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable David Carlier <devnexen(a)gmail.com> dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold D Scott Phillips <scott(a)os.amperecomputing.com> KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Michael Diesen <michael.diesen(a)posteo.de> ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 4 + .../bindings/ufs/qcom,sa8255p-ufshc.yaml | 9 +- Documentation/filesystems/erofs.rst | 9 +- Documentation/networking/af_xdp.rst | 54 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 12 +- arch/arm64/include/asm/kvm_hypevents.h | 1 + arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 1 + arch/arm64/kvm/hyp_trace.c | 36 +- arch/arm64/kvm/mmu.c | 4 + arch/arm64/kvm/vgic/vgic-its.c | 25 +- arch/arm64/kvm/vgic/vgic-v3.c | 8 +- arch/arm64/kvm/vgic/vgic.c | 18 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/Makefile | 2 +- arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 7 +- arch/s390/kvm/pci.c | 107 +++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/amd.c | 4 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- arch/x86/kvm/x86.c | 6 + drivers/accel/qaic/qaic_control.c | 2 +- drivers/acpi/cppc_acpi.c | 29 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 37 +- drivers/ata/libata-sata.c | 2 +- drivers/ata/libata-scsi.c | 119 +++- drivers/ata/libata.h | 3 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 86 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/cppc_cpufreq.c | 35 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/idxd/init.c | 36 +- drivers/dma/sun6i-dma.c | 11 +- drivers/dma/switchtec_dma.c | 2 +- drivers/gpio/gpio-by-pinctrl.c | 18 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpio/gpiolib.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 ++++++-- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 ++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +- drivers/gpu/drm/amd/include/kgd_pp_interface.h | 6 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 39 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 29 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 5 +- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- .../drm/amd/pm/swsmu/smu11/cyan_skillfish_ppt.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 8 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_8_ppt.c | 3 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 + drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_hdmi_v2.c | 8 - drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/tests/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_device.c | 56 +- drivers/gpu/drm/xe/xe_device.h | 4 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pci.c | 15 +- drivers/gpu/drm/xe/xe_pt.c | 13 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 87 ++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hv/mshv_eventfd.c | 41 +- drivers/hv/mshv_irq.c | 2 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root_main.c | 41 +- drivers/hv/mshv_vtl_main.c | 1 + drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 61 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-designware-platdrv.c | 80 +++ drivers/i2c/busses/i2c-imx.c | 54 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- drivers/infiniband/hw/mana/main.c | 40 +- drivers/infiniband/hw/mana/mana_ib.h | 14 + drivers/infiniband/hw/mana/qp.c | 68 ++- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/pages.c | 3 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/rcar/rcar_canfd.c | 32 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 86 ++- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 + drivers/net/ethernet/intel/idpf/idpf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 12 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 97 ++- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 49 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 - drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 19 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 143 +++-- drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 23 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/pci/controller/dwc/pci-imx6.c | 9 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 +- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/macsmc-power.c | 52 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 ++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/libsas/sas_scsi_host.c | 15 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 9 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 26 +- drivers/spi/spi-nxp-fspi.c | 83 ++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufs-rpmb.c | 2 - drivers/ufs/core/ufshcd.c | 46 +- drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 54 +- fs/btrfs/block-group.c | 34 +- fs/btrfs/block-rsv.c | 19 +- fs/btrfs/disk-io.c | 58 +- fs/btrfs/extent_io.c | 6 - fs/btrfs/extent_io.h | 6 + fs/btrfs/fs.h | 9 + fs/btrfs/raid56.c | 15 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 27 +- fs/erofs/Kconfig | 36 +- fs/erofs/Makefile | 1 - fs/erofs/data.c | 4 +- fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 664 --------------------- fs/erofs/inode.c | 2 +- fs/erofs/internal.h | 76 +-- fs/erofs/ishare.c | 101 ++-- fs/erofs/super.c | 94 +-- fs/erofs/zdata.c | 6 - fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 10 +- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 + fs/netfs/objects.c | 30 +- fs/netfs/read_pgpriv2.c | 3 +- fs/netfs/rolling_buffer.c | 22 +- fs/netfs/write_issue.c | 15 +- fs/ntfs/attrib.c | 10 + fs/ntfs/namei.c | 3 +- fs/ntfs/runlist.c | 50 +- fs/ocfs2/dir.c | 5 +- fs/proc/task_mmu.c | 34 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 14 +- fs/smb/server/smb_common.c | 37 +- fs/smb/server/vfs_cache.c | 6 +- include/acpi/cppc_acpi.h | 5 +- include/drm/drm_exec.h | 20 +- include/hyperv/hvhdk_mini.h | 3 +- include/kvm/arm_vgic.h | 3 - include/linux/alloc_tag.h | 3 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/ethtool.h | 1 + include/linux/iommu.h | 5 + include/linux/libata.h | 6 +- include/linux/memcontrol.h | 25 + include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/netfs.h | 1 + include/linux/rolling_buffer.h | 6 +- include/linux/slab.h | 19 +- include/linux/thunderbolt.h | 3 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip_vs.h | 45 +- include/net/mana/mana.h | 15 +- include/net/netfilter/nf_conntrack_expect.h | 3 + include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 9 +- include/scsi/libsas.h | 3 +- io_uring/cancel.c | 2 +- io_uring/net.c | 1 + io_uring/tctx.c | 7 +- io_uring/tctx.h | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + lib/test_hmm.c | 2 +- mm/huge_memory.c | 14 +- mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 97 ++- mm/util.c | 2 +- mm/vmscan.c | 11 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 220 ++++--- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 273 ++++++--- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/can/isotp.c | 334 ++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 4 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/fou_core.c | 2 +- net/ipv4/netfilter/nf_nat_h323.c | 22 +- net/ipv4/nexthop.c | 25 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/agg-tx.c | 4 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 192 ++++-- net/netfilter/ipvs/ip_vs_core.c | 190 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_expect.c | 35 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 22 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/tcp.c | 8 +- net/sched/cls_u32.c | 7 + net/sched/sch_cake.c | 8 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 257 +++++++- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 65 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_device.c | 2 +- sound/soc/sdca/sdca_fdl.c | 5 +- sound/soc/sdca/sdca_functions.c | 2 + sound/soc/sdca/sdca_ump.c | 4 +- sound/soc/sophgo/cv1800b-sound-adc.c | 10 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 56 +- tools/testing/selftests/net/af_unix/.gitignore | 1 + tools/testing/selftests/net/af_unix/Makefile | 1 + tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++ .../selftests/net/netfilter/nft_flowtable.sh | 14 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- 455 files changed, 6043 insertions(+), 3365 deletions(-)

1 week, 6 days

[PATCH 6.18 000/396] 6.18.44-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.44 release. There are 396 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.44-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.44-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Oak Zeng <oak.zeng(a)intel.com> drm/xe: Add page reclamation info to device info Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Matthew Brost <matthew.brost(a)intel.com> drm/xe: Use SVM range helpers in PT layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/vm: Prevent binding of purged buffer objects Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support Xin Wang <x.wang(a)intel.com> drm/xe/pat: Add helper to query compression enable status Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Tejas Upadhyay <tejas.upadhyay(a)intel.com> drm/xe/guc: Fix buffer overflow in steered register list allocation Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 340 Loic Poulain <loic.poulain(a)oss.qualcomm.com> media: qcom: camss: csid-340: Fix unused variables Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Close the submit-side sock_hold race Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Wang Liang <wangliang74(a)huawei.com> net/handshake: Fix null-ptr-deref in handshake_complete() Christian Brauner <brauner(a)kernel.org> net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() Christian Brauner <brauner(a)kernel.org> file: ensure cleanup Christian Brauner <brauner(a)kernel.org> file: add FD_{ADD,PREPARE}() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Jinank Jain <jinankjain(a)microsoft.com> mshv: adjust interrupt control structure for ARM64 Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not updating BIS sender source address Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HCI: Add initial support for PAST Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jason Xing <kernelxing(a)tencent.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kernelxing(a)tencent.com> xsk: use a smaller new lock for shared pool case Jason Xing <kernelxing(a)tencent.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states Kuniyuki Iwashima <kuniyu(a)google.com> selftest: af_unix: Create its own .gitignore. Sunday Adelodun <adelodunolaoluwa(a)yahoo.com> selftests: af_unix: Add tests for ECONNRESET and EOF semantics John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Allocate the paravisor SynIC pages when required Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Rename fields for SynIC message and event pages Roman Kisel <romank(a)linux.microsoft.com> arch/x86: mshyperv: Discover Confidential VMBus availability Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Fabian Lippold <fabianlippold1184(a)gmail.com> ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 Honglei Huang <honghuan(a)amd.com> drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/hwmon/ina2xx.rst | 25 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 4 +- arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/mmu.c | 4 + arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 78 ++++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/mshyperv.c | 28 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +-- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 +++++++++++---- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 +++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 12 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +-- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpusvm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 12 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 ++ drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 ++- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 ++- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/xe_bo.h | 56 ++++ drivers/gpu/drm/xe/xe_bo_types.h | 6 + drivers/gpu/drm/xe/xe_device_types.h | 2 + drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_guc_capture.c | 11 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_migrate.c | 90 ++++-- drivers/gpu/drm/xe/xe_migrate.h | 4 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++++ drivers/gpu/drm/xe/xe_pagefault.h | 19 ++ drivers/gpu/drm/xe/xe_pagefault_types.h | 136 +++++++++ drivers/gpu/drm/xe/xe_pat.c | 6 + drivers/gpu/drm/xe/xe_pat.h | 10 + drivers/gpu/drm/xe/xe_pci.c | 1 + drivers/gpu/drm/xe/xe_pci_types.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 31 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 119 ++++++-- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 107 +++++-- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/channel_mgmt.c | 6 +- drivers/hv/hv.c | 206 +++++++------ drivers/hv/hyperv_vmbus.h | 22 +- drivers/hv/mshv_eventfd.c | 43 ++- drivers/hv/mshv_irq.c | 6 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root.h | 2 +- drivers/hv/mshv_root_hv_call.c | 6 + drivers/hv/mshv_root_main.c | 8 +- drivers/hv/mshv_synic.c | 6 +- drivers/hv/vmbus_drv.c | 19 +- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/adt7470.c | 131 +++++--- drivers/hwmon/ina2xx.c | 107 +++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 54 +++- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/media/platform/qcom/camss/camss-csid-340.c | 28 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 ++- drivers/net/can/usb/ems_usb.c | 43 +++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 ++- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 ++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 ++ drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +-- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 +++++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 ++- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 ++++++-- drivers/spi/spi-nxp-fspi.c | 83 ++++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 ++- drivers/ufs/core/ufshcd.c | 41 +-- drivers/usb/typec/ucsi/ucsi.c | 88 +++--- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 22 +- fs/btrfs/raid56.c | 4 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 17 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_pgpriv2.c | 1 + fs/netfs/write_issue.c | 7 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 10 +- fs/smb/server/smb_common.c | 37 ++- fs/smb/server/vfs_cache.c | 6 +- include/asm-generic/mshyperv.h | 2 + include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/hyperv/hvhdk.h | 6 + include/hyperv/hvhdk_mini.h | 3 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/cleanup.h | 7 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/file.h | 125 ++++++++ include/linux/iommu.h | 5 + include/linux/libata.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/userfaultfd_k.h | 5 +- include/net/bluetooth/hci.h | 54 ++++ include/net/bluetooth/hci_core.h | 12 + include/net/bluetooth/mgmt.h | 2 + include/net/ip_vs.h | 45 ++- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 13 +- include/scsi/libsas.h | 1 - include/uapi/linux/rkisp1-config.h | 6 +- io_uring/net.c | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + mm/huge_memory.c | 12 + mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 76 ++--- mm/util.c | 2 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_event.c | 79 ++++- net/bluetooth/hci_sync.c | 157 ++++++---- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 301 ++++++++++++------ net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 96 ++++-- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++++++++++------ net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/handshake/handshake-test.c | 8 + net/handshake/handshake.h | 2 + net/handshake/netlink.c | 54 ++-- net/handshake/request.c | 65 +++- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 ++++++----- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +--- net/netfilter/ipvs/ip_vs_xmit.c | 42 ++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +-- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 73 +++-- net/xdp/xsk_buff_pool.c | 3 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_functions.c | 2 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 38 ++- tools/testing/kunit/kunit_tool_test.py | 42 +++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/net/.gitignore | 7 - tools/testing/selftests/net/af_unix/.gitignore | 9 + tools/testing/selftests/net/af_unix/Makefile | 2 + .../testing/selftests/net/af_unix/unix_connreset.c | 177 +++++++++++ tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++++++++ tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- 402 files changed, 5655 insertions(+), 2209 deletions(-)

1 week, 6 days

[PATCH 6.12 000/337] 6.12.103-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.103 release. There are 337 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.103-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.103-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom David Howells <dhowells(a)redhat.com> rxrpc: Fix irq-disabled in local_bh_enable() David Howells <dhowells(a)redhat.com> rxrpc: Manage RTT per-call rather than per-peer David Howells <dhowells(a)redhat.com> rxrpc: Fix the calculation and use of RTO David Howells <dhowells(a)redhat.com> rxrpc: Adjust the rxrpc_rtt_rx tracepoint David Howells <dhowells(a)redhat.com> rxrpc: Generate rtt_min Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Skip inactive MST connectors when building stream list Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: Hold a dma-buf reference for imported BOs Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/xe: Rename ___xe_bo_create_locked() Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: give each kernel job a unique id Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/sched: Store the drm client_id in drm_sched_fence Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Breno Leitao <leitao(a)debian.org> mm/kmemleak: fix checksum computation for per-cpu objects Catalin Marinas <catalin.marinas(a)arm.com> kmemleak: iommu/iova: fix transient kmemleak false positive Geliang Tang <geliang(a)kernel.org> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: pm: use addr entry for get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <geliang(a)kernel.org> mptcp: pm: avoid code duplication to lookup endp Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Lucas De Marchi <lucas.demarchi(a)intel.com> drm/xe: Apply whitelist to engine save-restore Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Introduce xe_gt_dbg_printer() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Wandun Chen <chenwandun(a)lixiang.com> of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Zheng Yejian <zhengyejian(a)huaweicloud.com> tracing: Remove TRACE_EVENT_FL_FILTERED logic Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: add consts for irq index Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: support named IRQs Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Wenliang Yan <wenliang202407(a)163.com> hwmon: (ina226) Add support for SY24655 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for INA260 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for has_alerts configuration flag Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Oreoluwa Babatunde <quic_obabatun(a)quicinc.com> of: reserved_mem: Add code to dynamically allocate reserved_mem array Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Jakub Kicinski <kuba(a)kernel.org> netconsole: avoid OOB reads, msg is not nul-terminated Tristan Madani <tristan(a)talencesecurity.com> bpf: Reset register bounds before narrowing retval range in check_mem_access() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Wayen.Yan <win847(a)gmail.com> net: airoha: Fix register index for Tx-fwd counter configuration Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Tiwei Bie <tiwei.btw(a)antgroup.com> um: Preserve errno within signal handler Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for userspace process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for write_sigio thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for ubd io thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Use os_set_pdeathsig helper in winch thread/process Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for winch thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Add os_set_pdeathsig helper function Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/dev-tools/kmemleak.rst | 1 + Documentation/hwmon/ina2xx.rst | 67 +- Makefile | 4 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 28 +- arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/chan_user.c | 2 + arch/um/drivers/ubd_kern.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/um/include/shared/os.h | 2 + arch/um/os-Linux/process.c | 6 + arch/um/os-Linux/sigio.c | 1 + arch/um/os-Linux/signal.c | 3 + arch/um/os-Linux/skas/process.c | 3 + arch/x86/kvm/svm/avic.c | 8 - drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 +- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.h | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 40 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 12 +- drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 13 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 699 +++++++++++---------- drivers/gpu/drm/i915/display/intel_hdcp_gsc.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp_gsc.h | 5 +- .../gpu/drm/i915/display/intel_hdcp_gsc_message.h | 3 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/imagination/pvr_job.c | 2 +- drivers/gpu/drm/imagination/pvr_queue.c | 5 +- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/lima/lima_sched.c | 6 +- drivers/gpu/drm/lima/lima_sched.h | 3 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/msm/msm_gem_submit.c | 8 +- drivers/gpu/drm/nouveau/nouveau_sched.c | 3 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 3 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/panthor/panthor_mmu.c | 2 +- drivers/gpu/drm/panthor/panthor_sched.c | 5 +- drivers/gpu/drm/panthor/panthor_sched.h | 3 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/scheduler/sched_fence.c | 4 +- drivers/gpu/drm/scheduler/sched_main.c | 7 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/v3d/v3d_submit.c | 2 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 7 +- drivers/gpu/drm/xe/xe_bo.c | 33 +- drivers/gpu/drm/xe/xe_bo.h | 10 +- drivers/gpu/drm/xe/xe_bo_types.h | 2 + drivers/gpu/drm/xe/xe_dma_buf.c | 6 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt.c | 4 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_gt_printk.h | 31 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++ drivers/gpu/drm/xe/xe_pagefault.h | 19 + drivers/gpu/drm/xe/xe_pagefault_types.h | 136 ++++ drivers/gpu/drm/xe/xe_pt.c | 3 + drivers/gpu/drm/xe/xe_reg_sr.c | 53 -- drivers/gpu/drm/xe/xe_reg_whitelist.c | 147 ++++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_sched_job.c | 3 +- drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/Kconfig | 5 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 251 ++++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/iommu/iova.c | 6 + drivers/media/i2c/imx219.c | 31 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 +- drivers/net/ethernet/airoha/airoha_eth.c | 2 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 58 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 7 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/netconsole.c | 3 +- drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 15 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/of_reserved_mem.c | 87 ++- drivers/phy/xilinx/phy-zynqmp.c | 130 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 6 + drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 +++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/usb/gadget/function/f_tcm.c | 192 +++++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/binfmt_misc.c | 8 + fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 6 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/server/vfs_cache.c | 6 +- include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/drm/gpu_scheduler.h | 12 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/kmemleak.h | 4 + include/linux/libata.h | 2 +- include/linux/mmc/sdio_ids.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/trace_events.h | 4 - include/net/ip_vs.h | 45 +- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/scsi/libsas.h | 1 - include/trace/events/rxrpc.h | 14 +- include/uapi/linux/rkisp1-config.h | 6 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/verifier.c | 1 + kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/trace.c | 44 +- kernel/trace/trace.h | 4 - kernel/trace/trace_branch.c | 4 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_functions_graph.c | 8 +- kernel/trace/trace_hwlat.c | 4 +- kernel/trace/trace_mmiotrace.c | 21 +- kernel/trace/trace_osnoise.c | 12 +- kernel/trace/trace_probe.c | 6 +- kernel/trace/trace_sched_wakeup.c | 8 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + lib/test_fortify/Makefile | 1 + lib/win_minmax.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 12 +- mm/kmemleak.c | 44 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 34 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 154 +++-- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 113 ++-- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 ++- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/rxrpc/ar-internal.h | 38 +- net/rxrpc/call_accept.c | 1 + net/rxrpc/call_event.c | 19 +- net/rxrpc/call_object.c | 2 + net/rxrpc/input.c | 12 +- net/rxrpc/output.c | 14 +- net/rxrpc/peer_object.c | 20 +- net/rxrpc/proc.c | 6 +- net/rxrpc/rtt.c | 103 +-- net/rxrpc/sendmsg.c | 2 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/pci/hda/patch_hdmi.c | 48 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 39 +- tools/testing/kunit/kunit_tool_test.py | 42 ++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- 387 files changed, 4750 insertions(+), 2372 deletions(-) From gregkh(a)linuxfoundation.org Fri Aug 7 16:34:18 2026 Message-ID: <20260807143418.550667215(a)linuxfoundation.org> User-Agent: quilt/0.69 Date: Fri, 07 Aug 2026 16:34:19 +0200 From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> To: stable(a)vger.kernel.org Cc: patches(a)lists.linux.dev, linux-kernel(a)vger.kernel.org, torvalds(a)linux-foundation.org, akpm(a)linux-foundation.org, linux(a)roeck-us.net, shuah(a)kernel.org, patches(a)kernelci.org, lkft-triage(a)lists.linaro.org, pavel(a)nabladev.com, jonathanh(a)nvidia.com, f.fainelli(a)gmail.com, sudipm.mukherjee(a)gmail.com, rwarsow(a)gmx.de, conor(a)kernel.org, hargar(a)microsoft.com, broonie(a)kernel.org, achill(a)achill.org, sr(a)sladewatkins.com, Ilya Maximets <i.maximets(a)ovn.org>, Pablo Neira Ayuso <pablo(a)netfilter.org>, Sasha Levin <sashal(a)kernel.org> X-stable: review X-Patchwork-Hint: ignore Subject: [PATCH 6.12 001/337] netfilter: nf_conntrack_expect: restore helper propagation via expectation MIME-Version: 1.0 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso <pablo(a)netfilter.org> [ Upstream commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a ] A recent series to fix expectations broke helper propagation via expectation, this mechanism is used by the sip and h323 helper. This also propagates the conntrack helper to expected connections. I changed semantics of exp->helper which now tells us the actual helper that created the expectation. Add an explicit assign_helper field to expectations for this purpose and update helpers to use it. Restore this feature for userspace conntrack helper via ctnetlink nfqueue integration so it is again possible to attach a helper to an expectation, where it makes sense. This is not restored via ctnetlink expectation creation as there is no client for such feature. Use the expectation layer 4 protocol number for the helper lookup for consistency. Make sure the expectation using this helper propagation mechanism also go away when the helper is unregistered. Fixes: 9c42bc9db90a ("netfilter: nf_conntrack_expect: honor expectation helper field") Fixes: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations") Reported-by: Ilya Maximets <i.maximets(a)ovn.org> Tested-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/net/netfilter/nf_conntrack_expect.h | 5 ++++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +++++-- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 ++++++------ net/netfilter/nf_conntrack_helper.c | 5 +++++ net/netfilter/nf_conntrack_netlink.c | 18 ++++++++++++++++-- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 39 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h index e9a8350e7ccf..80f50fd0f7ad 100644 --- a/include/net/netfilter/nf_conntrack_expect.h +++ b/include/net/netfilter/nf_conntrack_expect.h @@ -45,9 +45,12 @@ struct nf_conntrack_expect { void (*expectfn)(struct nf_conn *new, struct nf_conntrack_expect *this); - /* Helper to assign to new connection */ + /* Helper that created this expectation */ struct nf_conntrack_helper __rcu *helper; + /* Helper to assign to new connection */ + struct nf_conntrack_helper __rcu *assign_helper; + /* The conntrack of the master connection */ struct nf_conn *master; diff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c index f9528d4db0a8..93c501d9d399 100644 --- a/net/netfilter/nf_conntrack_broadcast.c +++ b/net/netfilter/nf_conntrack_broadcast.c @@ -72,6 +72,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->flags = NF_CT_EXPECT_PERMANENT; exp->class = NF_CT_EXPECT_CLASS_DEFAULT; rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 423080cf86a4..0c457e159727 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1773,14 +1773,17 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl)); if (exp) { + struct nf_conntrack_helper *assign_helper; + /* Welcome, Mr. Bond. We've been expecting you... */ __set_bit(IPS_EXPECTED_BIT, &ct->status); /* exp->master safe, refcnt bumped in nf_ct_find_expectation */ ct->master = exp->master; - if (exp->helper) { + assign_helper = rcu_dereference(exp->assign_helper); + if (assign_helper) { help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); if (help) - rcu_assign_pointer(help->helper, exp->helper); + rcu_assign_pointer(help->helper, assign_helper); } #ifdef CONFIG_NF_CONNTRACK_MARK diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index bb8b87f9ee50..a8929885485b 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -344,6 +344,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, helper = rcu_dereference(help->helper); rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 791aafe9f396..c42547284f35 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, &nf_conntrack_helper_h245); + rcu_assign_pointer(exp->assign_helper, &nf_conntrack_helper_h245); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3 : NULL, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */ nathook = rcu_dereference(nfct_h323_nat_hook); @@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_UDP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_ras); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_ras); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect RAS "); @@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); @@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 9150bcfd7ca8..ea0cdb7ec915 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -419,6 +419,11 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) this = rcu_dereference_protected(exp->helper, lockdep_is_held(&nf_conntrack_expect_lock)); + if (this == me) + return true; + + this = rcu_dereference_protected(exp->assign_helper, + lockdep_is_held(&nf_conntrack_expect_lock)); return this == me; } diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index eacbbc342c3f..80fdb875c977 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -2630,6 +2630,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask); @@ -2856,6 +2857,7 @@ static int ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, u32 portid, u32 report) { + struct nf_conntrack_helper *assign_helper = NULL; struct nlattr *cda[CTA_EXPECT_MAX+1]; struct nf_conntrack_tuple tuple, mask; struct nf_conntrack_expect *exp; @@ -2871,8 +2873,18 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, if (err < 0) return err; + if (cda[CTA_EXPECT_HELP_NAME]) { + const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]); + + assign_helper = __nf_conntrack_helper_find(helpname, + nf_ct_l3num(ct), + tuple.dst.protonum); + if (!assign_helper) + return -EOPNOTSUPP; + } + exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct, - &tuple, &mask); + assign_helper, &tuple, &mask); if (IS_ERR(exp)) return PTR_ERR(exp); @@ -3511,6 +3523,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr, static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { @@ -3564,6 +3577,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->zone = ct->zone; #endif rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, assign_helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3; exp->mask.src.u.all = mask->src.u.all; @@ -3619,7 +3633,7 @@ ctnetlink_create_expect(struct net *net, ct = nf_ct_tuplehash_to_ctrack(h); rcu_read_lock(); - exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask); + exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask); if (IS_ERR(exp)) { err = PTR_ERR(exp); goto err_rcu; diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bd91b8b47f4b..852c0b74b8a7 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1386,7 +1386,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff, nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct), saddr, &daddr, proto, NULL, &port); exp->timeout.expires = sip_timeout * HZ; - rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, helper); exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE; hooks = rcu_dereference(nf_nat_sip_hooks); -- 2.53.0

1 week, 6 days

[PATCH 6.6 000/261] 6.6.151-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.151 release. There are 261 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.151-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.151-rc1 Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/fbc: Extract intel_fbc_has_fences() Zhiling Zou <roxy520tt(a)gmail.com> sctp: close UDP tunnel sockets during netns teardown Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: use addr entry for get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: avoid code duplication to lookup endp WenTao Liang <vulab(a)iscas.ac.cn> ceph: fix refcount leak in ceph_readdir() Xiubo Li <xiubli(a)redhat.com> ceph: print cluster fsid and client global_id in all debug logs Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Thomas Weißschuh <linux(a)weissschuh.net> sysctl: treewide: constify ctl_table_header::ctl_table_arg Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: clone set on flush only David Howells <dhowells(a)redhat.com> rxrpc: Fix irq-disabled in local_bh_enable() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Calculate crop rectangle dynamically Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Group functions by purpose Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Don't store the current mode in the imx219 structure Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Access height from active format in imx219_set_ctrl Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: typec: ucsi: Only enable supported notifications Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Johan Hovold <johan(a)kernel.org> usb: musb: omap2430: clean up probe error handling Frank Scheiner <frank.scheiner(a)web.de> Revert "ia64: Make acpi_cpufreq_cpu_exit return void" Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Wei Yang <albinwyang(a)tencent.com> iommu/sva: move x86 disable check before allocation Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Pengfei Zhang <zhangfeionline(a)gmail.com> ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Kent Overstreet <kent.overstreet(a)gmail.com> sched: Add task_struct->faults_disabled_mapping Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Harshal Dev <harshal.dev(a)oss.qualcomm.com> soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Makefile | 4 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/s390/kvm/pci.c | 28 +- arch/um/drivers/vector_kern.c | 3 + arch/x86/kvm/svm/avic.c | 8 - drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/libata-eh.c | 8 + drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 +- drivers/cpufreq/ia64-acpi-cpufreq.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_fb_helper.c | 41 +- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_generic.c | 12 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 13 +- drivers/gpu/drm/i915/display/intel_display_core.h | 3 + .../gpu/drm/i915/display/intel_display_device.c | 3 + drivers/gpu/drm/i915/display/intel_display_types.h | 40 ++ drivers/gpu/drm/i915/display/intel_fbc.c | 9 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 266 ++++---- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/renesas/Kconfig | 1 + drivers/gpu/drm/renesas/Makefile | 1 + drivers/gpu/drm/renesas/rcar-du/Kconfig | 8 - drivers/gpu/drm/renesas/rcar-du/Makefile | 2 - drivers/gpu/drm/renesas/rz-du/Kconfig | 8 + drivers/gpu/drm/renesas/rz-du/Makefile | 3 + .../renesas/{rcar-du => rz-du}/rzg2l_mipi_dsi.c | 2 +- .../{rcar-du => rz-du}/rzg2l_mipi_dsi_regs.h | 0 drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/iommu/iommu-sva.c | 6 +- drivers/media/i2c/imx219.c | 670 ++++++++++--------- drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530.c | 58 +- drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_main.c | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 33 + drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/phy/phylink.c | 29 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 15 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 130 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 6 + drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/scsi_debug.c | 8 +- drivers/soc/qcom/ice.c | 17 +- drivers/spi/spi-cadence.c | 129 +++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/usb/gadget/function/f_tcm.c | 192 +++++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/typec/ucsi/ucsi.c | 113 ++-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/binfmt_misc.c | 4 + fs/btrfs/zoned.c | 6 +- fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 279 ++++---- fs/ceph/caps.c | 708 ++++++++++++--------- fs/ceph/crypto.c | 39 +- fs/ceph/debugfs.c | 6 +- fs/ceph/dir.c | 225 ++++--- fs/ceph/export.c | 39 +- fs/ceph/file.c | 245 ++++--- fs/ceph/inode.c | 485 +++++++------- fs/ceph/ioctl.c | 13 +- fs/ceph/locks.c | 57 +- fs/ceph/mds_client.c | 554 +++++++++------- fs/ceph/mdsmap.c | 24 +- fs/ceph/metric.c | 5 +- fs/ceph/quota.c | 29 +- fs/ceph/snap.c | 174 ++--- fs/ceph/super.c | 70 +- fs/ceph/super.h | 6 + fs/ceph/xattr.c | 96 +-- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/server/vfs_cache.c | 6 +- include/drm/drm_fb_helper.h | 12 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/libata.h | 2 +- include/linux/mmc/sdio_ids.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/sched.h | 1 + include/linux/sysctl.h | 2 +- include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 8 +- include/net/ip_vs.h | 45 +- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 2 + include/scsi/libsas.h | 1 - init/init_task.c | 1 + ipc/ipc_sysctl.c | 2 +- ipc/mq_sysctl.c | 2 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 1 + kernel/trace/trace_probe.c | 6 +- kernel/ucount.c | 2 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 12 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/ax25/sysctl_net_ax25.c | 2 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 19 +- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 8 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/sysctl_net_core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/devinet.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/route.c | 4 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/xfrm4_policy.c | 2 +- net/ipv6/addrconf.c | 2 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 17 +- net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/reassembly.c | 2 +- net/ipv6/sysctl_net_ipv6.c | 6 +- net/ipv6/xfrm6_policy.c | 2 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 5 +- net/mptcp/ctrl.c | 2 +- net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 ++- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_log.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 10 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/nft_set_pipapo.c | 11 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/rxrpc/ar-internal.h | 1 + net/rxrpc/call_accept.c | 1 + net/rxrpc/peer_object.c | 12 +- net/sctp/associola.c | 3 + net/sctp/protocol.c | 21 +- net/sctp/sm_make_chunk.c | 17 +- net/sctp/sysctl.c | 11 +- net/smc/smc_core.c | 2 +- net/smc/smc_sysctl.c | 2 +- net/tipc/socket.c | 2 +- net/unix/sysctl_net_unix.c | 2 +- net/xfrm/xfrm_sysctl.c | 2 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/core/ump.c | 1 + sound/pci/hda/patch_hdmi.c | 48 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- 305 files changed, 4972 insertions(+), 3146 deletions(-)

1 week, 6 days

ISE 2026 Attendees List 40% Off

by Alyssa Grant

Hi, We have the Integrated Systems Europe 2026 visitor database with 95,930 verified contacts available. 100% Opt-in & GDPR Compliant. Whether you're looking for the full attendee list or a specific audience segment, I'll be happy to share the available contact counts, sample records, and pricing. Q3 Promo: Enjoy 40% Off Kind regards, Alyssa Grant Sr. Demand Generation

2 weeks, 1 day

当たり前を疑う。社長のNG行動

by ナレッジリンク

　　　お世話になります。ナレッジリンクセミナー事務局です。　　・社員のモチベーションを上げようと声をかける　・現場のトラブルに、自ら先頭に立って対応する　　もし、社長がこれらを率先しているようであれば　残念ながら、その組織の成長はそこで止まります。　　社長の“優しさ”が、社員の甘えを生み、責任感を奪い　「指示待ち人間」を量産する装置になっているからです。　　　4,800社の経営者が衝撃を受けた、　良かれと思ってやってしまう「社長のNG行動」の正体。　　組織を劇的に変えるためのウェビナーです。　　1つでも心当たりがあれば、一度ご視聴ください。　　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　 ---------------------------------------------- 　　テーマ：　それ、危険です『社長のNG行動』　　　　　〜その行動が、組織崩壊を招く〜　　日程　：8月18日（火）13:00スタート　　　　　※どちらの日程も内容は同じ　会場　：Zoom開催　定員　：先着100名（費用は不要） ---------------------------------------------- 　※経営層の方限定です　　　なぜ、社員は「言われたこと」しかやらないのか。　なぜ、次世代のリーダー候補が育たないのか。　　それは、能力の問題ではなく、　　良かれと思って続けている「社長の配慮」こそが、　組織成長を止める、最大のボトルネックかもしれません。　　本セミナーでは、4,800社以上が導入した　独自の組織論「識学」に基づき、社長の「NG行動」と　真の経営者へ脱皮するためのマインドセットを伝授します。　　　【セミナー内容(一部抜粋)】　 ○ NG行動3選　 ○ なぜ優秀なNo.2や部長が育たないのか　 ○ マネジメントスタイルの変革について　 ○ 導入企業の事例　　「管理職が育ったら任せる」ではなく「任せるから育つ」　という思考の逆転を提言。　　現場から「冷たくなった」と思われることを恐れず　機能的な階層構造を作ることで　結果として社員全員を守り　利益を最大化させる道筋を明示します。　「優しさ」で人を動かすのではなく　「正しさ」で組織を動かす。　音声やお顔が表に出ることはございませんので　お気軽にご視聴ください。　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　　 ----------------------- 　一般社団法人ナレッジリンク　東京都千代田区神田小川町1-8-3 　電話：03-5256-7638 　セミナーのご案内が不要な方は大変残念ではございますが、　下記URLより手続き下さいませ。　　メール配信のワンクリック解除はこちら　https://fc-knowledgelink-corp.jp/mail/ 　

2 weeks, 5 days

[PATCH 6.6 000/484] 6.6.148-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.148 release. There are 484 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:41 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.148-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.148-rc1 Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug David Howells <dhowells(a)redhat.com> rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Julien Massot <julien.massot(a)collabora.com> ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() Chen-Yu Tsai <wenst(a)chromium.org> ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Qian Zuo <zuoqian113(a)gmail.com> coredump: fix pidfs file refcount leak in umh_coredump_setup Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Théo Lebrun <theo.lebrun(a)bootlin.com> net: macb: drop in-flight Tx SKBs on close Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Wentao Liang <vulab(a)iscas.ac.cn> ipmi: fix refcount leak in i_ipmi_request() Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Sergio Paracuellos <sergio.paracuellos(a)gmail.com> gpio: mt7621: avoid corruption of shared interrupt trigger state Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> pinctrl: remove pinctrl_gpio_direction_output() Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Michael Bommarito <michael.bommarito(a)gmail.com> tracing/user_events: Fix use-after-free in user_event_mm_dup() Marco Crivellari <marco.crivellari(a)suse.com> workqueue: Add system_percpu_wq and system_dfl_wq Tejun Heo <tj(a)kernel.org> workqueue: Factor out init_cpu_worker_pool() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: avoid double increment of &use_bh_wq_enabled Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Benjamin Coddington <ben.coddington(a)hammerspace.com> NFS: Charge unstable writes by request size, not folio size Christoph Hellwig <hch(a)lst.de> nfs: remove dead code for the old swap over NFS implementation Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> platform/x86: dell-laptop: fix missing cleanups in init error path Lyndon Sanche <lsanche(a)lyndeno.ca> platform/x86: dell-smbios: Move request functions for reuse Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> thunderbolt: Update property.c function documentation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> thunderbolt: Remove usage of the deprecated ida_simple_xx() API Gil Fine <gil.fine(a)linux.intel.com> thunderbolt: Handle lane bonding of Gen 4 XDomain links properly Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma-pcie: Reject devices without driver data Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> dmaengine: dw-edma: Fix confusing cleanup.h syntax Abinash Singh <abinashlalotra(a)gmail.com> dma: dw-edma: Fix build warning in dw_edma_pcie_probe() Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Pause continuous reads at block boundaries Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Ensure all continuous terms are always in sync Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Add a helper for calculating a page index Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Muchun Song <muchun.song(a)linux.dev> mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Jeff Layton <jlayton(a)kernel.org> sunrpc: allocate a separate bvec array for socket sends Mike Snitzer <snitzer(a)kernel.org> NFSD: pass nfsd_file to nfsd_iter_read() Theodor Arsenij Larionov-Trichkine <theodorlarionov(a)gmail.com> netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: remove register tracking infrastructure Yue Haibing <yuehaibing(a)huawei.com> netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link Abdun Nihaal <nihaal(a)cse.iitm.ac.in> fbdev: efifb: fix memory leak in efifb_probe() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/efifb: Replace references to global screen_info by local pointer Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Use irq-disabling spinlocks between app and I/O thread David Howells <dhowells(a)redhat.com> rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown David Howells <dhowells(a)redhat.com> rxrpc: Pull out certain app callback funcs into an ops table David Howells <dhowells(a)redhat.com> afs: Turn the afs_addr_list address array into an array of structs Kees Cook <keescook(a)chromium.org> afs: Annotate struct afs_addr_list with __counted_by Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Wentao Guan <guanwentao(a)uniontech.com> bpf: drop bpf_lsm_getselfattr from hook list Coia Prant <coiaprant(a)gmail.com> net: pcs: xpcs: fix SGMII state reading Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources Namjae Jeon <linkinjeon(a)kernel.org> exfat: validate cluster allocation bits of the allocation bitmap Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate ACE size against SID sub-authorities Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Weiming Shi <bestswngs(a)gmail.com> ipv6: ndisc: fix NULL deref in accept_untracked_na() Jacob Keller <jacob.e.keller(a)intel.com> i40e: remove read access to debugfs files Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture mapping leak Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho <luciano.coelho(a)intel.com> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled James Raphael Tiovalen <jamestiotio(a)gmail.com> vxlan: mdb: Fix source list corruption on a failed replace Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov <security(a)auditcode.ai> mac802154: hold an interface reference across the scan worker Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Reset triggers at top level before instance loop Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein <amir73il(a)gmail.com> fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann <max.kellermann(a)ionos.com> ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Haoran Jiang <jianghaoran(a)kylinos.cn> LoongArch: Fix oops during single-step debugging Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: set new_stream to NULL after release Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Thomas Zimmermann <tzimmermann(a)suse.de> drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Junrui Luo <moonafterrain(a)outlook.com> drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Marcin Szycik <marcin.szycik(a)linux.intel.com> ice: fix LAG recipe to profile association Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Qingfang Deng <dqfext(a)gmail.com> ppp: enable TX scatter-gather Qingfang Deng <dqfext(a)gmail.com> ppp: convert to percpu netstats Qingfang Deng <dqfext(a)gmail.com> ppp: use IFF_NO_QUEUE in virtual interfaces Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation vadik likholetov <vadikas(a)gmail.com> net: stmmac: enable the MAC on link up for all supported speeds Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Zhang Yi <yi.zhang(a)huawei.com> iomap: correct the range of a partial dirty clear Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Michael Walle <mwalle(a)kernel.org> net: dpaa: fix mode setting Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Kuniyuki Iwashima <kuniyu(a)amazon.com> selftest: af_unix: Add Kconfig file. Rishikesh Jethwani <rjethwani(a)purestorage.com> tls: device: push pending open record on splice EOF Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: check for workqueue allocation failure Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix auxiliary device add/del races Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: order completion reads after the ownership check Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: yield the CPU while waiting for the adminq to drain HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: reject component parameter in legacy firmware update Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: tear down new links on vif update error path Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: validate Realtek vendor event length Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: validate SAR GEO response payload size Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use complete_all() to signal init_completion Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix potential probe() deadlock Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Don't use devres to unregister component Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Pengpeng Hou <pengpeng(a)iscas.ac.cn> ASoC: tas2781: bound firmware description string parsing Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Qihang <q.h.hack.winter(a)gmail.com> ksmbd: pin conn during async oplock break notification Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Alexander Gordeev <agordeev(a)linux.ibm.com> sched/vtime: Get rid of generic vtime_task_switch() implementation Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Ruoyu Wang <ruoyuw560(a)gmail.com> Bluetooth: hci_qca: Clear memdump state on invalid dump size Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: use platform_get_irq() Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: cs42l43: Correct report for forced microphone jack Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Xue Lei <Xue.Lei(a)windriver.com> mtd: fix double free and WARN_ON in add_mtd_device() error paths Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Guoqing Jiang <guoqing.jiang(a)linux.dev> RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent rereg_mr for non-mem regions Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add helpers for umem dmabuf revoke lock Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add pinned revocable dmabuf import interface Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Move umem dmabuf revoke logic into helper function Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Yishai Hadas <yishaih(a)nvidia.com> RDMA/umem: Introduce an option to revoke DMABUF umem Yishai Hadas <yishaih(a)nvidia.com> RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Jhonraushan <raushan.jhon(a)gmail.com> accel/ivpu: Reject firmware log with size smaller than header Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Allow KASAN to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Cure some more scoped_seqlock() optimization fails Daniel Gibson <daniel(a)gibson.sh> platform/x86/amd/pmc: Avoid logging "(null)" for DMI values Daniel Gibson <daniel(a)gibson.sh> platform/x86/amd/pmc: Don't log during intermediate wakeups Ryosuke Yasuoka <ryasuoka(a)redhat.com> drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/kvm/arm.c | 2 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/mips/kvm/mips.c | 2 +- arch/powerpc/include/asm/cputime.h | 13 - arch/powerpc/kernel/time.c | 65 +++ arch/powerpc/kvm/powerpc.c | 2 +- arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kvm/aia.c | 35 +- arch/riscv/kvm/vcpu.c | 66 ++- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/kvm/x86.c | 4 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/accel/ivpu/ivpu_fw_log.c | 4 + drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-pcie.c | 63 +-- drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_bo.c | 10 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/core/umem_dmabuf.c | 176 ++++++- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 7 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/misc/ims-pcu.c | 37 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 25 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/md/dm-verity-target.c | 14 +- drivers/md/dm-verity.h | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + drivers/media/platform/marvell/cafe-driver.c | 1 + .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/mtd/nand/raw/nand_base.c | 43 +- drivers/net/amt.c | 87 +++- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 1 + drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 9 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +---- drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 28 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 ++-- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/geneve.c | 3 + drivers/net/gtp.c | 5 +- drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/ppp/ppp_generic.c | 154 +++--- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 14 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 4 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/platform/loongarch/loongson-laptop.c | 1 + drivers/platform/x86/amd/pmc/pmc.c | 39 +- drivers/platform/x86/amd/pmc/pmc.h | 1 + drivers/platform/x86/dell/dell-laptop.c | 28 +- drivers/platform/x86/dell/dell-smbios-base.c | 25 + drivers/platform/x86/dell/dell-smbios.h | 5 + .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 61 ++- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 149 ++++-- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vdpa/vdpa_user/iova_domain.c | 161 ++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 ++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 +++--- drivers/video/fbdev/core/fbcon_cw.c | 148 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- drivers/video/fbdev/efifb.c | 125 ++--- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/addr_list.c | 10 +- fs/afs/fs_probe.c | 6 +- fs/afs/internal.h | 6 +- fs/afs/proc.c | 4 +- fs/afs/rotate.c | 2 +- fs/afs/rxrpc.c | 15 +- fs/afs/server.c | 4 +- fs/afs/vl_alias.c | 4 +- fs/afs/vl_probe.c | 6 +- fs/afs/vl_rotate.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/ceph/ioctl.c | 6 + fs/coredump.c | 1 + fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/exfat/balloc.c | 54 ++- fs/f2fs/super.c | 25 +- fs/iomap/buffered-io.c | 12 +- fs/namei.c | 43 ++ fs/nfs/internal.h | 16 +- fs/nfs/pnfs_nfs.c | 2 +- fs/nfs/write.c | 14 +- fs/nfsd/nfs4xdr.c | 8 +- fs/nfsd/vfs.c | 7 +- fs/nfsd/vfs.h | 2 +- fs/overlayfs/copy_up.c | 12 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/smb/client/misc.c | 34 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smbacl.c | 42 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/firmware.h | 3 + include/linux/fscrypt.h | 18 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/ppp_channel.h | 3 +- include/linux/seqlock.h | 10 +- include/linux/sunrpc/svcsock.h | 3 + include/linux/sunrpc/xdr.h | 19 +- include/linux/vtime.h | 6 + include/linux/workqueue.h | 8 +- include/media/videobuf2-core.h | 8 +- include/net/af_rxrpc.h | 25 +- include/net/bluetooth/rfcomm.h | 3 + include/net/netfilter/nf_tables.h | 37 -- include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 3 - include/net/sctp/structs.h | 3 +- include/rdma/ib_umem.h | 41 ++ include/trace/events/rxrpc.h | 3 +- include/uapi/linux/btrfs.h | 2 +- init/main.c | 39 -- io_uring/rw.c | 28 +- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/verifier.c | 17 + kernel/locking/spinlock_rt.c | 27 +- kernel/sched/cputime.c | 13 - kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 13 + kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events_user.c | 43 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- kernel/workqueue.c | 46 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/damon/core.c | 13 + mm/mm_init.c | 34 +- net/bluetooth/hci_sync.c | 13 +- net/bluetooth/mgmt.c | 42 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/nft_meta_bridge.c | 20 - net/bridge/netfilter/nft_reject_bridge.c | 1 - net/can/bcm.c | 528 +++++++++++++++------ net/can/isotp.c | 278 ++++++++--- net/can/j1939/transport.c | 18 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/netfilter/nft_dup_ipv4.c | 1 - net/ipv4/netfilter/nft_fib_ipv4.c | 2 - net/ipv4/netfilter/nft_reject_ipv4.c | 1 - net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_tunnel.c | 3 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nft_dup_ipv6.c | 1 - net/ipv6/netfilter/nft_fib_ipv6.c | 2 - net/ipv6/netfilter/nft_reject_ipv6.c | 1 - net/ipv6/raw.c | 2 +- net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/rx.c | 2 + net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mpls/af_mpls.c | 3 + net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_tables_api.c | 67 --- net/netfilter/nft_bitwise.c | 104 ---- net/netfilter/nft_byteorder.c | 11 - net/netfilter/nft_cmp.c | 3 - net/netfilter/nft_compat.c | 10 - net/netfilter/nft_connlimit.c | 1 - net/netfilter/nft_counter.c | 1 - net/netfilter/nft_ct.c | 46 -- net/netfilter/nft_dup_netdev.c | 1 - net/netfilter/nft_dynset.c | 1 - net/netfilter/nft_exthdr.c | 34 -- net/netfilter/nft_fib.c | 51 +- net/netfilter/nft_fib_inet.c | 1 - net/netfilter/nft_fib_netdev.c | 30 +- net/netfilter/nft_flow_offload.c | 1 - net/netfilter/nft_fwd_netdev.c | 2 - net/netfilter/nft_hash.c | 36 -- net/netfilter/nft_immediate.c | 12 - net/netfilter/nft_last.c | 1 - net/netfilter/nft_limit.c | 2 - net/netfilter/nft_log.c | 1 - net/netfilter/nft_lookup.c | 12 - net/netfilter/nft_masq.c | 3 - net/netfilter/nft_meta.c | 45 -- net/netfilter/nft_nat.c | 2 - net/netfilter/nft_numgen.c | 22 - net/netfilter/nft_objref.c | 2 - net/netfilter/nft_osf.c | 25 - net/netfilter/nft_payload.c | 47 -- net/netfilter/nft_queue.c | 2 - net/netfilter/nft_quota.c | 1 - net/netfilter/nft_range.c | 1 - net/netfilter/nft_redir.c | 3 - net/netfilter/nft_reject_inet.c | 1 - net/netfilter/nft_reject_netdev.c | 1 - net/netfilter/nft_rt.c | 1 - net/netfilter/nft_set_pipapo.c | 259 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 26 - net/netfilter/nft_synproxy.c | 1 - net/netfilter/nft_tproxy.c | 1 - net/netfilter/nft_tunnel.c | 26 - net/netfilter/nft_xfrm.c | 27 -- net/openvswitch/actions.c | 15 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/recv.c | 15 + net/rxrpc/af_rxrpc.c | 24 +- net/rxrpc/ar-internal.h | 3 +- net/rxrpc/call_accept.c | 77 +-- net/rxrpc/call_object.c | 42 +- net/rxrpc/conn_client.c | 12 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/conn_object.c | 8 +- net/rxrpc/input.c | 5 +- net/rxrpc/io_thread.c | 8 +- net/rxrpc/peer_event.c | 8 +- net/rxrpc/peer_object.c | 1 + net/rxrpc/recvmsg.c | 26 +- net/rxrpc/rxperf.c | 10 +- net/rxrpc/security.c | 4 +- net/rxrpc/sendmsg.c | 8 +- net/rxrpc/txbuf.c | 4 +- net/sched/act_tunnel_key.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sunrpc/svcsock.c | 51 +- net/sunrpc/xdr.c | 210 +++++++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 7 +- net/tls/tls_device.c | 6 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 20 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 4 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 36 +- security/selinux/hooks.c | 99 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++- security/smack/smack_netfilter.c | 4 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 25 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 ++- sound/soc/mediatek/mt6797/mt6797-afe-pcm.c | 14 +- sound/soc/mediatek/mt7986/mt7986-afe-pcm.c | 14 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 26 +- sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 21 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 135 ++---- sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 54 +-- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 38 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/quirks.c | 2 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++ tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/af_unix/config | 4 + tools/testing/selftests/net/openvswitch/config | 16 + virt/kvm/kvm_main.c | 3 + 561 files changed, 6388 insertions(+), 4060 deletions(-)

2 weeks, 6 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage August 2026