Lkft-triage August 2026

lkft-triage@lists.linaro.org

36 participants
50 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.8 release. There are 438 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.8-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.8-rc1 Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Matthew Brost <matthew.brost(a)intel.com> drm/xe: Set TTM device beneficial_order to 9 (2M) Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Separate early xe_device initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.devid|revid initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Move xe->info.force_execlist initialization Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Drop unused param from xe_device_create() Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Alan Swanson <reiver(a)improbability.net> drm/amd/display: Silence link_dpms I2C retimer failures Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames George Zhang <george.zhang(a)amd.com> drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport Alex Deucher <alexander.deucher(a)amd.com> drm/amd/display: check if dml21_add_phantom_plane() is successful Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: use milliwatts for GPU power sensors Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: hide pp_table sysfs on APUs Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Guangshuo Li <lgs201920130244(a)gmail.com> drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Close speculative mem read possibility Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Sasha Finkelstein <k(a)chaosmail.tech> power: supply: macsmc: Support macOS 27 SMC firmware Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Christian Loehle <christian.loehle(a)arm.com> cpufreq: cppc: Sanitize lockless policy limit snapshots Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Daniel Golle <daniel(a)makrotopia.org> gpiolib: tolerate gpio-hogs lacking a hogging state Hardik Prakash <hardikprakash.official(a)gmail.com> i2c: designware: defer probe if child GpioInt controllers are not bound Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Shawn Guo <shengchao.guo(a)oss.qualcomm.com> scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <dlemoal(a)kernel.org> scsi: libsas: terminate deferred commands on time out Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Jiakai Xu <xujiakai2025(a)iscas.ac.cn> riscv/mm: use physical alignment for vmemmap_start_pfn Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kyumin Lee <fyonglkm(a)gmail.com> io_uring: preserve task restrictions across exec Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: fix tid_tx use-after-free on BA session stop Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Soeren Moch <smoch(a)web.de> PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> fou: Fix use-after-free in fou_create() Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: schedule deferred atapi command Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Usama Arif <usama.arif(a)linux.dev> userfaultfd: wait on source PMD during UFFDIO_MOVE Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Stanislav Kinsburskii <skinsburskii(a)gmail.com> lib: test_hmm: use device devt for coherent device range selection Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Mykola Lysenko <nickolay.lysenko(a)gmail.com> btrfs: raid56: fix scrub read assembly submitting no reads Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Qi Zheng <qi.zheng(a)linux.dev> mm: mglru: fix stale batch updates after memcg reparenting Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Check all controls for fast switching Nicolas Schier <n.schier(a)fritz.com> kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Reject DMABUF pages from the access pin path Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Publish VP to pt_vp_array before installing the file descriptor Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix missing error code on VP allocation failure Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use memcmp() to compare ClientGUIDs Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Aditya Garg <gargaditya(a)linux.microsoft.com> net: mana: Return error code from mana_create_rxq() Long Li <longli(a)microsoft.com> net: mana: Create separate EQs for each vPort Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: Fix E2E delay mechanism Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Thomas Weißschuh <thomas.weissschuh(a)linutronix.de> riscv: vdso: Only try to install vDSO when present Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> ipv6: release fib6_null_entry on subtree failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix reader page read offset for remote buffers Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/pt: check no-DMA huge-pte cases before DMA segment test Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Ao Sun <ao.sun(a)transsion.com> scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Block VFs from clobbering special CGX PKIND state Ratheesh Kannoth <rkannoth(a)marvell.com> octeontx2: cn20k: Coordinate default rules with NIX LF lifecycle Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_past_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Michael Bommarito <michael.bommarito(a)gmail.com> idpf: bound interrupt-vector register fill to the allocated array Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller David Howells <dhowells(a)redhat.com> netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Eric Joyner <eric.joyner(a)amd.com> ethtool: Embed FEC hist ranges as buffer in struct Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove Surendra Singh Chouhan <kr494167(a)gmail.com> ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Baochen Qiang <baochen.qiang(a)oss.qualcomm.com> wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() Christian Loehle <christian.loehle(a)arm.com> ACPI: CPPC: Skip writes to unsupported performance controls Alex Tran <alex.tran(a)oss.qualcomm.com> gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper Gao Xiang <xiang(a)kernel.org> erofs: ensure valid f_path for page cache sharing Gao Xiang <xiang(a)kernel.org> erofs: remove fscache backend entirely Gao Xiang <xiang(a)kernel.org> erofs: clean up erofs_ishare_fill_inode() Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jonas Köppeler <j.koeppeler(a)tu-berlin.de> net/sched: sch_cake: skip clearing unused tins during rate adjustment Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: reclaim invalid Tx descriptors in ZC batch path Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: provide sufficient space in pool->tx_descs Jason Xing <kerneljasonxing(a)gmail.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kerneljasonxing(a)gmail.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: take nh->lock for f6i_list walks in replace check and notify Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Make UMP message size check more robust Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Always free firmware in FDL path Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Correct pointer passed to devm_acpi_table_put Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: clear the nfct flag under lock Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Julian Anastasov <ja(a)ssi.bg> ipvs: adjust double hashing when fwd method changes Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Add missing hyp_enter when trapping sysreg Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing Vincent Donnefort <vdonnefort(a)google.com> KVM: arm64: Fix hyp_trace clock disabling Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Mitigate potential LPI registration failure Carlos López <clopez(a)suse.de> KVM: arm64: vgic: Fix race between LPI release and re-registration Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Yi Xie <xieyi(a)kylinos.cn> mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() Lorenzo Bianconi <lorenzo(a)kernel.org> selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Tomas Glozar <tglozar(a)redhat.com> rtla/timerlat_top: Fix on-threshold actions firing on signal Namjae Jeon <linkinjeon(a)kernel.org> ntfs: drop stale page-cache when shrinking a non-resident attr Namjae Jeon <linkinjeon(a)kernel.org> ntfs: harden runlist realloc size calculations Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: skip fully truncated ordered extents at zone finish Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Dongjiang Zhu <zhudongjiang(a)fnnas.com> btrfs: skip global block reserve accounting for rescue mounts Qu Wenruo <wqu(a)suse.com> btrfs: warn about extent buffer that can not be released Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Namjae Jeon <linkinjeon(a)kernel.org> ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix double free of wq, engine, and group structs Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable David Carlier <devnexen(a)gmail.com> dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold D Scott Phillips <scott(a)os.amperecomputing.com> KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Michael Diesen <michael.diesen(a)posteo.de> ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 4 + .../bindings/ufs/qcom,sa8255p-ufshc.yaml | 9 +- Documentation/filesystems/erofs.rst | 9 +- Documentation/networking/af_xdp.rst | 54 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 12 +- arch/arm64/include/asm/kvm_hypevents.h | 1 + arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 1 + arch/arm64/kvm/hyp_trace.c | 36 +- arch/arm64/kvm/mmu.c | 4 + arch/arm64/kvm/vgic/vgic-its.c | 25 +- arch/arm64/kvm/vgic/vgic-v3.c | 8 +- arch/arm64/kvm/vgic/vgic.c | 18 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/Makefile | 2 +- arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 7 +- arch/s390/kvm/pci.c | 107 +++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/amd.c | 4 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- arch/x86/kvm/x86.c | 6 + drivers/accel/qaic/qaic_control.c | 2 +- drivers/acpi/cppc_acpi.c | 29 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 37 +- drivers/ata/libata-sata.c | 2 +- drivers/ata/libata-scsi.c | 119 +++- drivers/ata/libata.h | 3 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 86 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/cppc_cpufreq.c | 35 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/idxd/init.c | 36 +- drivers/dma/sun6i-dma.c | 11 +- drivers/dma/switchtec_dma.c | 2 +- drivers/gpio/gpio-by-pinctrl.c | 18 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpio/gpiolib.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 ++++++-- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 ++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +- drivers/gpu/drm/amd/include/kgd_pp_interface.h | 6 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 39 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 29 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 5 +- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- .../drm/amd/pm/swsmu/smu11/cyan_skillfish_ppt.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 8 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_8_ppt.c | 3 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 + drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_hdmi_v2.c | 8 - drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/tests/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_device.c | 56 +- drivers/gpu/drm/xe/xe_device.h | 4 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pci.c | 15 +- drivers/gpu/drm/xe/xe_pt.c | 13 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 87 ++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hv/mshv_eventfd.c | 41 +- drivers/hv/mshv_irq.c | 2 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root_main.c | 41 +- drivers/hv/mshv_vtl_main.c | 1 + drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 61 +- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-designware-platdrv.c | 80 +++ drivers/i2c/busses/i2c-imx.c | 54 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- drivers/infiniband/hw/mana/main.c | 40 +- drivers/infiniband/hw/mana/mana_ib.h | 14 + drivers/infiniband/hw/mana/qp.c | 68 ++- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/pages.c | 3 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/rcar/rcar_canfd.c | 32 +- drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 86 ++- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 + drivers/net/ethernet/intel/idpf/idpf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/idpf/idpf_vf_dev.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 12 + drivers/net/ethernet/marvell/octeontx2/af/cgx.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 79 +++ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 97 ++- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 49 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 8 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 - drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 19 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 143 +++-- drivers/net/ethernet/microsoft/mana/mana_ethtool.c | 23 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/net/wireless/ath/ath12k/mac.c | 5 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/pci/controller/dwc/pci-imx6.c | 9 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 +- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/macsmc-power.c | 52 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 ++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/libsas/sas_scsi_host.c | 15 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 9 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 26 +- drivers/spi/spi-nxp-fspi.c | 83 ++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufs-rpmb.c | 2 - drivers/ufs/core/ufshcd.c | 46 +- drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 54 +- fs/btrfs/block-group.c | 34 +- fs/btrfs/block-rsv.c | 19 +- fs/btrfs/disk-io.c | 58 +- fs/btrfs/extent_io.c | 6 - fs/btrfs/extent_io.h | 6 + fs/btrfs/fs.h | 9 + fs/btrfs/raid56.c | 15 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 27 +- fs/erofs/Kconfig | 36 +- fs/erofs/Makefile | 1 - fs/erofs/data.c | 4 +- fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 664 --------------------- fs/erofs/inode.c | 2 +- fs/erofs/internal.h | 76 +-- fs/erofs/ishare.c | 101 ++-- fs/erofs/super.c | 94 +-- fs/erofs/zdata.c | 6 - fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 10 +- fs/netfs/internal.h | 1 + fs/netfs/main.c | 7 + fs/netfs/objects.c | 30 +- fs/netfs/read_pgpriv2.c | 3 +- fs/netfs/rolling_buffer.c | 22 +- fs/netfs/write_issue.c | 15 +- fs/ntfs/attrib.c | 10 + fs/ntfs/namei.c | 3 +- fs/ntfs/runlist.c | 50 +- fs/ocfs2/dir.c | 5 +- fs/proc/task_mmu.c | 34 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 14 +- fs/smb/server/smb_common.c | 37 +- fs/smb/server/vfs_cache.c | 6 +- include/acpi/cppc_acpi.h | 5 +- include/drm/drm_exec.h | 20 +- include/hyperv/hvhdk_mini.h | 3 +- include/kvm/arm_vgic.h | 3 - include/linux/alloc_tag.h | 3 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/ethtool.h | 1 + include/linux/iommu.h | 5 + include/linux/libata.h | 6 +- include/linux/memcontrol.h | 25 + include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/netfs.h | 1 + include/linux/rolling_buffer.h | 6 +- include/linux/slab.h | 19 +- include/linux/thunderbolt.h | 3 + include/net/bluetooth/hci_core.h | 4 +- include/net/ip_vs.h | 45 +- include/net/mana/mana.h | 15 +- include/net/netfilter/nf_conntrack_expect.h | 3 + include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 9 +- include/scsi/libsas.h | 3 +- io_uring/cancel.c | 2 +- io_uring/net.c | 1 + io_uring/tctx.c | 7 +- io_uring/tctx.h | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + lib/test_hmm.c | 2 +- mm/huge_memory.c | 14 +- mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 97 ++- mm/util.c | 2 +- mm/vmscan.c | 11 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 220 ++++--- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 273 ++++++--- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/can/isotp.c | 334 ++++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/transport.c | 4 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/fou_core.c | 2 +- net/ipv4/netfilter/nf_nat_h323.c | 22 +- net/ipv4/nexthop.c | 25 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/agg-tx.c | 4 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 192 ++++-- net/netfilter/ipvs/ip_vs_core.c | 190 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_expect.c | 35 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 22 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/tcp.c | 8 +- net/sched/cls_u32.c | 7 + net/sched/sch_cake.c | 8 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 257 +++++++- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 65 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_device.c | 2 +- sound/soc/sdca/sdca_fdl.c | 5 +- sound/soc/sdca/sdca_functions.c | 2 + sound/soc/sdca/sdca_ump.c | 4 +- sound/soc/sophgo/cv1800b-sound-adc.c | 10 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 56 +- tools/testing/selftests/net/af_unix/.gitignore | 1 + tools/testing/selftests/net/af_unix/Makefile | 1 + tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++ .../selftests/net/netfilter/nft_flowtable.sh | 14 +- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- tools/tracing/rtla/src/timerlat_top.c | 2 +- 455 files changed, 6043 insertions(+), 3365 deletions(-)

1 month

[PATCH 6.18 000/396] 6.18.44-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.44 release. There are 396 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.44-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.44-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Oak Zeng <oak.zeng(a)intel.com> drm/xe: Add page reclamation info to device info Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Matthew Brost <matthew.brost(a)intel.com> drm/xe: Use SVM range helpers in PT layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/vm: Prevent binding of purged buffer objects Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support Xin Wang <x.wang(a)intel.com> drm/xe/pat: Add helper to query compression enable status Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Exit idle optimizations before programming Leo Li <sunpeng.li(a)amd.com> drm/amd/display: check GRPH_FLIP status before sending event Tejas Upadhyay <tejas.upadhyay(a)intel.com> drm/xe/guc: Fix buffer overflow in steered register list allocation Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 340 Loic Poulain <loic.poulain(a)oss.qualcomm.com> media: qcom: camss: csid-340: Fix unused variables Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Drain pending requests at net namespace exit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Close the submit-side sock_hold race Chuck Lever <chuck.lever(a)oracle.com> net/handshake: hand off the pinned file reference to accept_doit Chuck Lever <chuck.lever(a)oracle.com> net/handshake: Take a long-lived file reference at submit Wang Liang <wangliang74(a)huawei.com> net/handshake: Fix null-ptr-deref in handshake_complete() Christian Brauner <brauner(a)kernel.org> net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() Christian Brauner <brauner(a)kernel.org> file: ensure cleanup Christian Brauner <brauner(a)kernel.org> file: add FD_{ADD,PREPARE}() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: enforce cursor size limits for MOB cursors Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: clamp dirty-page range with min, not max Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> drm/bridge: display-connector: Fix I2C adapter resource leak Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Carlos Song <carlos.song(a)nxp.com> i2c: imx: mark I2C adapter when hardware is powered down Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers Linmao Li <lilinmao(a)kylinos.cn> i2c: spacemit: request IRQ after controller initialization Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Stanislaw Pal <kuncy7(a)gmail.com> spi: spi-qpic-snand: write the feature value before executing SET_FEATURE Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Breno Leitao <leitao(a)debian.org> uprobes: Fix NULL pointer dereference in hprobe_expire() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Jens Axboe <axboe(a)kernel.dk> io_uring/net: initialize mshot_len for send Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps Carlo Caione <ccaione(a)baylibre.com> of/address: Fix NULL bus dereference in of_pci_range_parser_one() David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Wei Liu <wei.liu(a)kernel.org> mshv: fix hv_input_get_system_property struct Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Eckhart Mohr <e.mohr(a)tuxedocomputers.com> ALSA: hda/realtek: Add quirk for TongFang X6SP45xU Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe David Howells <dhowells(a)redhat.com> afs: Fix UAF when sending a message David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to subtract transferred from len David Howells <dhowells(a)redhat.com> afs: Fix afs_fs_fetch_data() to set call->async Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> Bluetooth: SCO: give the socket its own sco_conn reference Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Hidayath Khan <hidayath(a)linux.ibm.com> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Paolo Bonzini <pbonzini(a)redhat.com> KVM: VMX: add memory clobber to asm for VMX instructions Raushan Patel <raushan.jhon(a)gmail.com> tracing/fprobe: Roll back on enable_trace_fprobe() failure Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Jori Koolstra <jkoolstra(a)xs4all.nl> selftest: fix headers in fclog.c Aboorva Devarajan <aboorvad(a)linux.ibm.com> mm/util: don't read __page_2 for order-1 folios in snapshot_page() Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix IOPF group ownership UAF Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds Nicolin Chen <nicolinc(a)nvidia.com> iommufd/viommu: Release the igroup lock on the vdevice_size error path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Order pt_vp_array publish against irqfd assertion path Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix level-triggered check on uninitialized data Jinank Jain <jinankjain(a)microsoft.com> mshv: adjust interrupt control structure for ARM64 Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix race in mshv_irqfd_deassign Christoph Hellwig <hch(a)lst.de> iomap: add a separate bio_set for iomap_split_ioend Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Jerome Tollet <jerome.tollet(a)gmail.com> drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Haibo Chen <haibo.chen(a)nxp.com> spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Wei Fang <wei.fang(a)nxp.com> ptp: netc: fix potential interrupt storm caused by incorrect unbind order Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Anirudh Srinivasan <asrinivasan(a)oss.tenstorrent.com> riscv: drop __init from vec_check_unaligned_access_speed_all_cpus Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix module reference count leak on error in register_fprobe() Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Mauricio Faria de Oliveira <mfo(a)igalia.com> x86/boot: Add volatile, clobbers and zero-length test in memcmp() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix refcounting of iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: ensure no dangling hcon references in iso_conn Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: hold sk properly in iso_conn_ready Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: ISO: Fix not updating BIS sender source address Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_connect_ind SeungJu Cheon <suunj1331(a)gmail.com> Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HCI: Add initial support for PAST Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: lock sk in iso_sock_getname Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Przemyslaw Korba <przemyslaw.korba(a)intel.com> ice: suppress DPLL errors during reset recovery Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Yichong Chen <chenyichong(a)uniontech.com> netfs: release readahead folios on iterator preparation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: handle single writeback rolling buffer allocation failure Yichong Chen <chenyichong(a)uniontech.com> netfs: clear PG_private_2 on copy-to-cache append failure Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 wangdicheng <wangdicheng(a)kylinos.cn> ASoC: tas2781: Use correct calibration data for SINEGAIN2 register Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Jason Xing <kernelxing(a)tencent.com> xsk: drain continuation descs after overflow in xsk_build_skb() Jason Xing <kernelxing(a)tencent.com> xsk: use a smaller new lock for shared pool case Jason Xing <kernelxing(a)tencent.com> xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx John Ericson <mail(a)johnericson.me> selftests/net/af_unix: test listen() rejects wrong socket states Kuniyuki Iwashima <kuniyu(a)google.com> selftest: af_unix: Create its own .gitignore. Sunday Adelodun <adelodunolaoluwa(a)yahoo.com> selftests: af_unix: Add tests for ECONNRESET and EOF semantics John Ericson <mail(a)johnericson.me> af_unix: fix listen() succeeding on sockets in the wrong state Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Ensure that Control Range is large enough for header Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Alexandru Elisei <alexandru.elisei(a)arm.com> KVM: arm64: Reject guest_memfd memslots when the VM has MTE Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix sleeping under spinlock in mshv_portid_alloc Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix duplicate GSI detection for GSI 0 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Allocate the paravisor SynIC pages when required Roman Kisel <romank(a)linux.microsoft.com> Drivers: hv: Rename fields for SynIC message and event pages Roman Kisel <romank(a)linux.microsoft.com> arch/x86: mshyperv: Discover Confidential VMBus availability Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Qu Wenruo <wqu(a)suse.com> btrfs: raid56: fix an incorrect csum skip during scrub Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: reset meta_write_pointer on zone reset Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Krishna Kurapati <krishna.kurapati(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Fix return value of init call Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> selftests/seccomp: Fix pointer type mismatch build error Haofeng Li <lihaofeng(a)kylinos.cn> selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Fabian Lippold <fabianlippold1184(a)gmail.com> ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 Honglei Huang <honghuan(a)amd.com> drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/hwmon/ina2xx.rst | 25 +- Documentation/virt/kvm/api.rst | 6 + Makefile | 4 +- arch/arm64/kvm/arm.c | 25 +- arch/arm64/kvm/mmu.c | 4 + arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/kernel/unaligned_access_speed.c | 4 +- arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 78 ++++- arch/s390/kvm/pci.h | 2 + arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/x86/boot/string.c | 11 +- arch/x86/kernel/cpu/mshyperv.c | 28 +- arch/x86/kvm/svm/avic.c | 8 - arch/x86/kvm/vmx/vmx_ops.h | 8 +- drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci_ceva.c | 18 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 ++- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dibs/dibs_loopback.c | 47 +-- drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 39 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 243 +++++++++++---- drivers/gpu/drm/amd/display/dc/core/dc.c | 45 +++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 12 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/bridge/display-connector.c | 11 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +-- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpusvm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 12 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdmi.c | 26 ++ drivers/gpu/drm/i915/display/intel_hdmi.h | 2 + drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 ++- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 ++- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/xe_bo.h | 56 ++++ drivers/gpu/drm/xe/xe_bo_types.h | 6 + drivers/gpu/drm/xe/xe_device_types.h | 2 + drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_guc_capture.c | 11 +- drivers/gpu/drm/xe/xe_hw_engine.c | 2 + drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_migrate.c | 90 ++++-- drivers/gpu/drm/xe/xe_migrate.h | 4 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++++ drivers/gpu/drm/xe/xe_pagefault.h | 19 ++ drivers/gpu/drm/xe/xe_pagefault_types.h | 136 +++++++++ drivers/gpu/drm/xe/xe_pat.c | 6 + drivers/gpu/drm/xe/xe_pat.h | 10 + drivers/gpu/drm/xe/xe_pci.c | 1 + drivers/gpu/drm/xe/xe_pci_types.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 31 +- drivers/gpu/drm/xe/xe_reg_whitelist.c | 119 ++++++-- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_vm.c | 107 +++++-- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/channel_mgmt.c | 6 +- drivers/hv/hv.c | 206 +++++++------ drivers/hv/hyperv_vmbus.h | 22 +- drivers/hv/mshv_eventfd.c | 43 ++- drivers/hv/mshv_irq.c | 6 +- drivers/hv/mshv_portid_table.c | 6 +- drivers/hv/mshv_root.h | 2 +- drivers/hv/mshv_root_hv_call.c | 6 + drivers/hv/mshv_root_main.c | 8 +- drivers/hv/mshv_synic.c | 6 +- drivers/hv/vmbus_drv.c | 19 +- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/adt7470.c | 131 +++++--- drivers/hwmon/ina2xx.c | 107 +++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 54 +++- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-k1.c | 10 +- drivers/i2c/busses/i2c-qcom-cci.c | 18 +- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 15 + drivers/iommu/io-pgfault.c | 24 +- drivers/iommu/iommufd/device.c | 2 +- drivers/iommu/iommufd/eventq.c | 2 + drivers/iommu/iommufd/viommu.c | 22 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/media/platform/qcom/camss/camss-csid-340.c | 28 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 ++- drivers/net/can/usb/ems_usb.c | 43 +++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 ++- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 ++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 19 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/virt/queues.c | 21 ++ drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +-- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 21 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/address.c | 22 +- drivers/of/of_reserved_mem.c | 14 +- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 62 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/ptp/ptp_netc.c | 15 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/pkey_cca.c | 15 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 89 +++++- drivers/s390/crypto/zcrypt_ccamisc.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 ++- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 ++++++-- drivers/spi/spi-nxp-fspi.c | 83 ++++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/spi/spi-qpic-snand.c | 22 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 ++- drivers/ufs/core/ufshcd.c | 41 +-- drivers/usb/typec/ucsi/ucsi.c | 88 +++--- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/afs/fsclient.c | 5 +- fs/afs/internal.h | 3 +- fs/binfmt_misc.c | 22 +- fs/btrfs/raid56.c | 4 +- fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 17 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/iomap/ioend.c | 21 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_pgpriv2.c | 1 + fs/netfs/write_issue.c | 7 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/client/inode.c | 1 + fs/smb/server/connection.h | 5 + fs/smb/server/smb2pdu.c | 10 +- fs/smb/server/smb_common.c | 37 ++- fs/smb/server/vfs_cache.c | 6 +- include/asm-generic/mshyperv.h | 2 + include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/hyperv/hvhdk.h | 6 + include/hyperv/hvhdk_mini.h | 3 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/cleanup.h | 7 + include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/file.h | 125 ++++++++ include/linux/iommu.h | 5 + include/linux/libata.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/userfaultfd_k.h | 5 +- include/net/bluetooth/hci.h | 54 ++++ include/net/bluetooth/hci_core.h | 12 + include/net/bluetooth/mgmt.h | 2 + include/net/ip_vs.h | 45 ++- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/net/xdp_sock.h | 1 + include/net/xsk_buff_pool.h | 13 +- include/scsi/libsas.h | 1 - include/uapi/linux/rkisp1-config.h | 6 +- io_uring/net.c | 1 + kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_fprobe.c | 12 +- kernel/trace/trace_mmiotrace.c | 13 +- kernel/trace/trace_probe.c | 6 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/test_fortify/Makefile | 1 + mm/huge_memory.c | 12 + mm/hugetlb.c | 12 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 76 ++--- mm/util.c | 2 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_event.c | 79 ++++- net/bluetooth/hci_sync.c | 157 ++++++---- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 301 ++++++++++++------ net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 96 ++++-- net/bluetooth/sco.c | 22 +- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++++++++++------ net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/pktgen.c | 4 +- net/core/skbuff.c | 18 +- net/handshake/handshake-test.c | 8 + net/handshake/handshake.h | 2 + net/handshake/netlink.c | 54 ++-- net/handshake/request.c | 65 +++- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 ++++++----- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +-- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +--- net/netfilter/ipvs/ip_vs_xmit.c | 42 ++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +-- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 1 + net/xdp/xsk.c | 73 +++-- net/xdp/xsk_buff_pool.c | 3 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/hda/codecs/realtek/alc269.c | 4 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/fsl/fsl_asrc.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/sdca/sdca_functions.c | 2 + sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 38 ++- tools/testing/kunit/kunit_tool_test.py | 42 +++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/filesystems/fclog.c | 4 +- tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- tools/testing/selftests/net/.gitignore | 7 - tools/testing/selftests/net/af_unix/.gitignore | 9 + tools/testing/selftests/net/af_unix/Makefile | 2 + .../testing/selftests/net/af_unix/unix_connreset.c | 177 +++++++++++ tools/testing/selftests/net/af_unix/unix_listen.c | 187 ++++++++++++ tools/testing/selftests/seccomp/seccomp_bpf.c | 3 +- 402 files changed, 5655 insertions(+), 2209 deletions(-)

1 month

[PATCH 6.12 000/337] 6.12.103-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.103 release. There are 337 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.103-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.103-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Bart Van Assche <bvanassche(a)acm.org> drm/fb-helper: Fix a locking bug in an error path Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom David Howells <dhowells(a)redhat.com> rxrpc: Fix irq-disabled in local_bh_enable() David Howells <dhowells(a)redhat.com> rxrpc: Manage RTT per-call rather than per-peer David Howells <dhowells(a)redhat.com> rxrpc: Fix the calculation and use of RTO David Howells <dhowells(a)redhat.com> rxrpc: Adjust the rxrpc_rtt_rx tracepoint David Howells <dhowells(a)redhat.com> rxrpc: Generate rtt_min Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Stub out new pagefault layer Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Skip inactive MST connectors when building stream list Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: Hold a dma-buf reference for imported BOs Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/xe: Rename ___xe_bo_create_locked() Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Wait on external BO kernel fences in exec IOCTL Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: give each kernel job a unique id Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/sched: Store the drm client_id in drm_sched_fence Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Breno Leitao <leitao(a)debian.org> mm/kmemleak: fix checksum computation for per-cpu objects Catalin Marinas <catalin.marinas(a)arm.com> kmemleak: iommu/iova: fix transient kmemleak false positive Geliang Tang <geliang(a)kernel.org> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: pm: use addr entry for get_local_id Geliang Tang <geliang(a)kernel.org> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <geliang(a)kernel.org> mptcp: pm: avoid code duplication to lookup endp Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Jackson Lee <jackson.lee(a)chipsnmedia.com> media: chips-media: wave5: Support CBP profile Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: prevent unbounded recursion in free path with new kmalloc type Harry Yoo (Oracle) <harry(a)kernel.org> lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Ensure locking/ref counting for OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: (De-)whitelist OA registers on OA stream open/release Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Save OA nonpriv registers to register save/restore lists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Generalize whitelist_apply_to_hwe Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Keep track of non-OA nonpriv slots Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Maintain OA whitelists separately Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Lucas De Marchi <lucas.demarchi(a)intel.com> drm/xe: Apply whitelist to engine save-restore Michal Wajdeczko <michal.wajdeczko(a)intel.com> drm/xe: Introduce xe_gt_dbg_printer() Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Wandun Chen <chenwandun(a)lixiang.com> of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore William Palacek <William.Palacek(a)amd.com> drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Jiri Slaby (SUSE) <jirislaby(a)kernel.org> drm/amd/display: use proper context for logging Ray Wu <ray.wu(a)amd.com> drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: validate firmware interface structure sizes Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: reject firmware sections with oversized data Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: Fix s390_pci_mmio_write syscall error return without MIO Jianing Li <m13940358460(a)163.com> power: supply: max17040: handle missing status supplier Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Breno Leitao <leitao(a)debian.org> mm: memcg: initialize *locked in memcg1_oom_prepare() stub Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't let an 'F' entry pin its own instance Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix stack info leak in RME Digiface status Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Niklas Cassel <cassel(a)kernel.org> ata: libata-sata: fix ata_scsi_lpm_supported() iteration Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: Fix division by zero in initialize_timer() Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Kiryl Shutsemau (Meta) <kas(a)kernel.org> fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Gabriele Monaco <gmonaco(a)redhat.com> sched/deadline: Use revised wakeup rule only for running dl_server Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix FDIR ATR queue mismatch for software VLAN packets Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Karl Mehltretter <kmehltretter(a)gmail.com> riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Zheng Yejian <zhengyejian(a)huaweicloud.com> tracing: Remove TRACE_EVENT_FL_FILTERED logic Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix leaking sk after socket release Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Yuho Choi <dbgh9129(a)gmail.com> idpf: Fix mailbox IRQ name leak on request failure Joshua Hay <joshua.a.hay(a)intel.com> idpf: adjust TxQ ring count minimum Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: add consts for irq index Frank Wunderlich <frank-w(a)public-files.de> net: ethernet: mtk_eth_soc: support named IRQs Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Eric Dumazet <edumazet(a)google.com> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Yun Lu <luyun(a)kylinos.cn> rtase: fix double free of multi-frag skb on DMA map failure Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (sht3x) Fix unaligned accesses Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix reading the minimum alarm voltage Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Fix various overflow issues Jonas Rebmann <jre(a)pengutronix.de> hwmon: (ina2xx) Shift INA234 shunt and current registers Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Add support for INA234 Ian Ray <ian.ray(a)gehealthcare.com> hwmon: (ina2xx) Make it easier to add more devices Wenliang Yan <wenliang202407(a)163.com> hwmon: (ina226) Add support for SY24655 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for INA260 Guenter Roeck <linux(a)roeck-us.net> hwmon: (ina2xx) Add support for has_alerts configuration flag Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: make nft_object rhltable per table Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Fabrice Derepas <fabrice.derepas(a)canonical.com> KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Qu Wenruo <wqu(a)suse.com> btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Sang-Heon Jeon <ekffu200098(a)gmail.com> of: reserved_mem: prevent OOB when too many dynamic regions are defined Oreoluwa Babatunde <quic_obabatun(a)quicinc.com> of: reserved_mem: Add code to dynamically allocate reserved_mem array Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Abdun Nihaal <nihaal(a)cse.iitm.ac.in> gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Sneh Mankad <sneh.mankad(a)oss.qualcomm.com> pinctrl: qcom: Unconditionally mark gpio as wakeup enable Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Jakub Kicinski <kuba(a)kernel.org> netconsole: avoid OOB reads, msg is not nul-terminated Tristan Madani <tristan(a)talencesecurity.com> bpf: Reset register bounds before narrowing retval range in check_mem_access() Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Wayen.Yan <win847(a)gmail.com> net: airoha: Fix register index for Tx-fwd counter configuration Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Tiwei Bie <tiwei.btw(a)antgroup.com> um: Preserve errno within signal handler Shuvam Pandey <shuvampandey1(a)gmail.com> kunit: tool: skip stty when stdin is not a tty David Gow <david(a)davidgow.net> kunit: tool: Terminate kernel under test on SIGINT Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for userspace process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for write_sigio thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Set parent-death signal for ubd io thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Use os_set_pdeathsig helper in winch thread/process Benjamin Berg <benjamin.berg(a)intel.com> um: Set parent death signal for winch thread/process Tiwei Bie <tiwei.btw(a)antgroup.com> um: Add os_set_pdeathsig helper function Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Documentation/dev-tools/kmemleak.rst | 1 + Documentation/hwmon/ina2xx.rst | 67 +- Makefile | 4 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/riscv/mm/init.c | 4 +- arch/s390/kvm/pci.c | 28 +- arch/s390/pci/pci_mmio.c | 1 + arch/um/drivers/chan_user.c | 2 + arch/um/drivers/ubd_kern.c | 1 + arch/um/drivers/vector_kern.c | 3 + arch/um/include/shared/os.h | 2 + arch/um/os-Linux/process.c | 6 + arch/um/os-Linux/sigio.c | 1 + arch/um/os-Linux/signal.c | 3 + arch/um/os-Linux/skas/process.c | 3 + arch/x86/kvm/svm/avic.c | 8 - drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/libata-eh.c | 8 + drivers/ata/libata-sata.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 +- drivers/bluetooth/btusb.c | 30 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpio/gpio-sloppy-logic-analyzer.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.h | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 40 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 12 +- drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_exec.c | 6 +- drivers/gpu/drm/drm_fb_helper.c | 41 +- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_shmem.c | 12 +- drivers/gpu/drm/drm_fbdev_ttm.c | 12 +- drivers/gpu/drm/drm_gpuvm.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 13 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 699 +++++++++++---------- drivers/gpu/drm/i915/display/intel_hdcp_gsc.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp_gsc.h | 5 +- .../gpu/drm/i915/display/intel_hdcp_gsc_message.h | 3 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/imagination/pvr_job.c | 2 +- drivers/gpu/drm/imagination/pvr_queue.c | 5 +- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/lima/lima_sched.c | 6 +- drivers/gpu/drm/lima/lima_sched.h | 3 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/msm/msm_gem_submit.c | 8 +- drivers/gpu/drm/nouveau/nouveau_sched.c | 3 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 3 +- drivers/gpu/drm/panthor/panthor_fw.c | 47 +- drivers/gpu/drm/panthor/panthor_mmu.c | 2 +- drivers/gpu/drm/panthor/panthor_sched.c | 5 +- drivers/gpu/drm/panthor/panthor_sched.h | 3 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/scheduler/sched_fence.c | 4 +- drivers/gpu/drm/scheduler/sched_main.c | 7 +- drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/v3d/v3d_submit.c | 2 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 17 +- drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 7 +- drivers/gpu/drm/xe/xe_bo.c | 33 +- drivers/gpu/drm/xe/xe_bo.h | 10 +- drivers/gpu/drm/xe/xe_bo_types.h | 2 + drivers/gpu/drm/xe/xe_dma_buf.c | 6 +- drivers/gpu/drm/xe/xe_exec.c | 22 +- drivers/gpu/drm/xe/xe_gt.c | 4 +- drivers/gpu/drm/xe/xe_gt_debugfs.c | 4 +- drivers/gpu/drm/xe/xe_gt_printk.h | 31 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/gpu/drm/xe/xe_hw_engine_types.h | 8 + drivers/gpu/drm/xe/xe_oa.c | 7 + drivers/gpu/drm/xe/xe_oa_types.h | 3 + drivers/gpu/drm/xe/xe_pagefault.c | 65 ++ drivers/gpu/drm/xe/xe_pagefault.h | 19 + drivers/gpu/drm/xe/xe_pagefault_types.h | 136 ++++ drivers/gpu/drm/xe/xe_pt.c | 3 + drivers/gpu/drm/xe/xe_reg_sr.c | 53 -- drivers/gpu/drm/xe/xe_reg_whitelist.c | 147 ++++- drivers/gpu/drm/xe/xe_reg_whitelist.h | 4 + drivers/gpu/drm/xe/xe_sched_job.c | 3 +- drivers/gpu/drm/xe/xe_vm.c | 3 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hv/vmbus_drv.c | 13 +- drivers/hwmon/Kconfig | 5 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/ina2xx.c | 251 ++++++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/ltc4282.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/hwmon/sht3x.c | 9 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 + drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/iommu/iova.c | 6 + drivers/media/i2c/imx219.c | 31 +- .../media/platform/chips-media/wave5/wave5-hw.c | 3 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 5 +- .../platform/chips-media/wave5/wave5-vpuapi.h | 1 + drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530-mdio.c | 11 +- drivers/net/dsa/mt7530.c | 58 +- drivers/net/ethernet/airoha/airoha_eth.c | 2 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 58 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 7 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/realtek/rtase/rtase_main.c | 3 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 + drivers/net/netconsole.c | 3 +- drivers/net/phy/phylink.c | 29 +- drivers/net/veth.c | 4 +- drivers/net/vxlan/vxlan_core.c | 15 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/of/of_reserved_mem.c | 87 ++- drivers/phy/xilinx/phy-zynqmp.c | 130 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 8 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/power/supply/max17040_battery.c | 6 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 6 + drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/scsi_debug.c | 8 +- drivers/spi/spi-cadence.c | 129 +++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/usb/gadget/function/f_tcm.c | 192 +++++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/typec/ucsi/ucsi.c | 88 +-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/binfmt_misc.c | 8 + fs/btrfs/super.c | 8 +- fs/btrfs/zoned.c | 6 +- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/proc/task_mmu.c | 33 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/server/vfs_cache.c | 6 +- include/drm/drm_exec.h | 20 +- include/drm/drm_fb_helper.h | 12 - include/drm/gpu_scheduler.h | 12 +- include/linux/alloc_tag.h | 3 + include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/kmemleak.h | 4 + include/linux/libata.h | 2 +- include/linux/mmc/sdio_ids.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/slab.h | 8 +- include/linux/thunderbolt.h | 3 + include/linux/trace_events.h | 4 - include/net/ip_vs.h | 45 +- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 4 +- include/scsi/libsas.h | 1 - include/trace/events/rxrpc.h | 14 +- include/uapi/linux/rkisp1-config.h | 6 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/bpf/verifier.c | 1 + kernel/sched/cpufreq_schedutil.c | 11 + kernel/sched/deadline.c | 3 +- kernel/trace/trace.c | 44 +- kernel/trace/trace.h | 4 - kernel/trace/trace_branch.c | 4 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_functions_graph.c | 8 +- kernel/trace/trace_hwlat.c | 4 +- kernel/trace/trace_mmiotrace.c | 21 +- kernel/trace/trace_osnoise.c | 12 +- kernel/trace/trace_probe.c | 6 +- kernel/trace/trace_sched_wakeup.c | 8 +- lib/alloc_tag.c | 9 + lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + lib/test_fortify/Makefile | 1 + lib/win_minmax.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 12 +- mm/kmemleak.c | 44 +- mm/memcontrol-v1.h | 6 +- mm/migrate_device.c | 5 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- mm/slab.h | 28 +- mm/slab_common.c | 13 + mm/slub.c | 34 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 154 +++-- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 113 ++-- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 6 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/skbuff.c | 18 +- net/ipv4/route.c | 2 - net/ipv4/udp_tunnel_nic.c | 32 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 1 + net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 ++- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 34 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/rxrpc/ar-internal.h | 38 +- net/rxrpc/call_accept.c | 1 + net/rxrpc/call_event.c | 19 +- net/rxrpc/call_object.c | 2 + net/rxrpc/input.c | 12 +- net/rxrpc/output.c | 14 +- net/rxrpc/peer_object.c | 20 +- net/rxrpc/proc.c | 6 +- net/rxrpc/rtt.c | 103 +-- net/rxrpc/sendmsg.c | 2 +- net/sctp/associola.c | 3 + net/sctp/sm_make_chunk.c | 17 +- net/smc/smc_core.c | 2 +- net/tipc/socket.c | 2 +- security/keys/keyring.c | 14 +- security/keys/trusted-keys/trusted_dcp.c | 15 +- sound/core/pcm_native.c | 7 + sound/core/seq/seq_timer.c | 9 +- sound/core/timer.c | 2 + sound/core/ump.c | 1 + sound/pci/hda/patch_hdmi.c | 48 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- sound/usb/mixer_quirks.c | 2 +- tools/testing/kunit/kunit_kernel.py | 39 +- tools/testing/kunit/kunit_tool_test.py | 42 ++ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- 387 files changed, 4750 insertions(+), 2372 deletions(-) From gregkh(a)linuxfoundation.org Fri Aug 7 16:34:18 2026 Message-ID: <20260807143418.550667215(a)linuxfoundation.org> User-Agent: quilt/0.69 Date: Fri, 07 Aug 2026 16:34:19 +0200 From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> To: stable(a)vger.kernel.org Cc: patches(a)lists.linux.dev, linux-kernel(a)vger.kernel.org, torvalds(a)linux-foundation.org, akpm(a)linux-foundation.org, linux(a)roeck-us.net, shuah(a)kernel.org, patches(a)kernelci.org, lkft-triage(a)lists.linaro.org, pavel(a)nabladev.com, jonathanh(a)nvidia.com, f.fainelli(a)gmail.com, sudipm.mukherjee(a)gmail.com, rwarsow(a)gmx.de, conor(a)kernel.org, hargar(a)microsoft.com, broonie(a)kernel.org, achill(a)achill.org, sr(a)sladewatkins.com, Ilya Maximets <i.maximets(a)ovn.org>, Pablo Neira Ayuso <pablo(a)netfilter.org>, Sasha Levin <sashal(a)kernel.org> X-stable: review X-Patchwork-Hint: ignore Subject: [PATCH 6.12 001/337] netfilter: nf_conntrack_expect: restore helper propagation via expectation MIME-Version: 1.0 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso <pablo(a)netfilter.org> [ Upstream commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a ] A recent series to fix expectations broke helper propagation via expectation, this mechanism is used by the sip and h323 helper. This also propagates the conntrack helper to expected connections. I changed semantics of exp->helper which now tells us the actual helper that created the expectation. Add an explicit assign_helper field to expectations for this purpose and update helpers to use it. Restore this feature for userspace conntrack helper via ctnetlink nfqueue integration so it is again possible to attach a helper to an expectation, where it makes sense. This is not restored via ctnetlink expectation creation as there is no client for such feature. Use the expectation layer 4 protocol number for the helper lookup for consistency. Make sure the expectation using this helper propagation mechanism also go away when the helper is unregistered. Fixes: 9c42bc9db90a ("netfilter: nf_conntrack_expect: honor expectation helper field") Fixes: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations") Reported-by: Ilya Maximets <i.maximets(a)ovn.org> Tested-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/net/netfilter/nf_conntrack_expect.h | 5 ++++- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +++++-- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 ++++++------ net/netfilter/nf_conntrack_helper.c | 5 +++++ net/netfilter/nf_conntrack_netlink.c | 18 ++++++++++++++++-- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 39 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h index e9a8350e7ccf..80f50fd0f7ad 100644 --- a/include/net/netfilter/nf_conntrack_expect.h +++ b/include/net/netfilter/nf_conntrack_expect.h @@ -45,9 +45,12 @@ struct nf_conntrack_expect { void (*expectfn)(struct nf_conn *new, struct nf_conntrack_expect *this); - /* Helper to assign to new connection */ + /* Helper that created this expectation */ struct nf_conntrack_helper __rcu *helper; + /* Helper to assign to new connection */ + struct nf_conntrack_helper __rcu *assign_helper; + /* The conntrack of the master connection */ struct nf_conn *master; diff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c index f9528d4db0a8..93c501d9d399 100644 --- a/net/netfilter/nf_conntrack_broadcast.c +++ b/net/netfilter/nf_conntrack_broadcast.c @@ -72,6 +72,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->flags = NF_CT_EXPECT_PERMANENT; exp->class = NF_CT_EXPECT_CLASS_DEFAULT; rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 423080cf86a4..0c457e159727 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1773,14 +1773,17 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl)); if (exp) { + struct nf_conntrack_helper *assign_helper; + /* Welcome, Mr. Bond. We've been expecting you... */ __set_bit(IPS_EXPECTED_BIT, &ct->status); /* exp->master safe, refcnt bumped in nf_ct_find_expectation */ ct->master = exp->master; - if (exp->helper) { + assign_helper = rcu_dereference(exp->assign_helper); + if (assign_helper) { help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); if (help) - rcu_assign_pointer(help->helper, exp->helper); + rcu_assign_pointer(help->helper, assign_helper); } #ifdef CONFIG_NF_CONNTRACK_MARK diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index bb8b87f9ee50..a8929885485b 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -344,6 +344,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, helper = rcu_dereference(help->helper); rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, NULL); write_pnet(&exp->net, net); #ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone; diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 791aafe9f396..c42547284f35 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, &nf_conntrack_helper_h245); + rcu_assign_pointer(exp->assign_helper, &nf_conntrack_helper_h245); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); nathook = rcu_dereference(nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3, @@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3 : NULL, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */ nathook = rcu_dereference(nfct_h323_nat_hook); @@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct, nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct), &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_UDP, NULL, &port); - rcu_assign_pointer(exp->helper, nf_conntrack_helper_ras); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_ras); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect RAS "); @@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); @@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags = NF_CT_EXPECT_PERMANENT; - rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931); + rcu_assign_pointer(exp->assign_helper, nf_conntrack_helper_q931); if (nf_ct_expect_related(exp, 0) == 0) { pr_debug("nf_ct_ras: expect Q.931 "); diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 9150bcfd7ca8..ea0cdb7ec915 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -419,6 +419,11 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data) this = rcu_dereference_protected(exp->helper, lockdep_is_held(&nf_conntrack_expect_lock)); + if (this == me) + return true; + + this = rcu_dereference_protected(exp->assign_helper, + lockdep_is_held(&nf_conntrack_expect_lock)); return this == me; } diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index eacbbc342c3f..80fdb875c977 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -2630,6 +2630,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask); @@ -2856,6 +2857,7 @@ static int ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, u32 portid, u32 report) { + struct nf_conntrack_helper *assign_helper = NULL; struct nlattr *cda[CTA_EXPECT_MAX+1]; struct nf_conntrack_tuple tuple, mask; struct nf_conntrack_expect *exp; @@ -2871,8 +2873,18 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, if (err < 0) return err; + if (cda[CTA_EXPECT_HELP_NAME]) { + const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]); + + assign_helper = __nf_conntrack_helper_find(helpname, + nf_ct_l3num(ct), + tuple.dst.protonum); + if (!assign_helper) + return -EOPNOTSUPP; + } + exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct, - &tuple, &mask); + assign_helper, &tuple, &mask); if (IS_ERR(exp)) return PTR_ERR(exp); @@ -3511,6 +3523,7 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr, static struct nf_conntrack_expect * ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, + const struct nf_conntrack_helper *assign_helper, struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { @@ -3564,6 +3577,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->zone = ct->zone; #endif rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, assign_helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3; exp->mask.src.u.all = mask->src.u.all; @@ -3619,7 +3633,7 @@ ctnetlink_create_expect(struct net *net, ct = nf_ct_tuplehash_to_ctrack(h); rcu_read_lock(); - exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask); + exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask); if (IS_ERR(exp)) { err = PTR_ERR(exp); goto err_rcu; diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bd91b8b47f4b..852c0b74b8a7 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1386,7 +1386,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff, nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct), saddr, &daddr, proto, NULL, &port); exp->timeout.expires = sip_timeout * HZ; - rcu_assign_pointer(exp->helper, helper); + rcu_assign_pointer(exp->assign_helper, helper); exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE; hooks = rcu_dereference(nf_nat_sip_hooks); -- 2.53.0

1 month

[PATCH 6.6 000/261] 6.6.151-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.151 release. There are 261 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 09 Aug 2026 14:33:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.151-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.151-rc1 Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/fbc: Extract intel_fbc_has_fences() Zhiling Zou <roxy520tt(a)gmail.com> sctp: close UDP tunnel sockets during netns teardown Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: use addr entry for get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: avoid code duplication to lookup endp WenTao Liang <vulab(a)iscas.ac.cn> ceph: fix refcount leak in ceph_readdir() Xiubo Li <xiubli(a)redhat.com> ceph: print cluster fsid and client global_id in all debug logs Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Thomas Weißschuh <linux(a)weissschuh.net> sysctl: treewide: constify ctl_table_header::ctl_table_arg Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: clone set on flush only David Howells <dhowells(a)redhat.com> rxrpc: Fix irq-disabled in local_bh_enable() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Calculate crop rectangle dynamically Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Group functions by purpose Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Don't store the current mode in the imx219 structure Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Access height from active format in imx219_set_ctrl Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Thomas Zimmermann <tzimmermann(a)suse.de> drm/fb-helper: Allocate and release fb_info in single place Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: typec: ucsi: Only enable supported notifications Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Johan Hovold <johan(a)kernel.org> usb: musb: omap2430: clean up probe error handling Frank Scheiner <frank.scheiner(a)web.de> Revert "ia64: Make acpi_cpufreq_cpu_exit return void" Junjie Cao <junjie.cao(a)intel.com> gpio: pch: use raw_spinlock_t for the register lock Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios Kiryl Shutsemau (Meta) <kas(a)kernel.org> mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() Wei Yang <albinwyang(a)tencent.com> iommu/sva: move x86 disable check before allocation Niklas Cassel <cassel(a)kernel.org> ata: ahci: Make ahci_ignore_port() handle empty mask_port_map Damien Le Moal <dlemoal(a)kernel.org> ata: libahci_platform: Do not set mask_port_map when not needed HyeongJun An <sammiee5311(a)gmail.com> HID: logitech-dj: Fix maxfield check in DJ short report validation Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate external BO copy bounds for both stride paths Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: use check_add_overflow for shader size+offset bound Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: bound DMA command body size against suffix pointer Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: validate DRAW_PRIMITIVES header size before division Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: drop dma_buf reference on foreign-fd prime import Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: reject DX_BIND_QUERY without a DX context Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size William Palacek <William.Palacek(a)amd.com> drm/amdkfd: hold event_mutex while checkpointing CRIU events David Francis <David.Francis(a)amd.com> drm/amdkfd: Handle invalid event type in CRIU event restore Vladimir Marioukhine <Vladimir.Marioukhine(a)amd.com> drm/amdkfd: fix QID bit leak in pqm_create_queue() Gang Ba <Gang.Ba(a)amd.com> drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Harkirat Gill <harkirat.gill(a)amd.com> drm/amdgpu: cap GTT size to physical RAM on APUs Candice Li <candice.li(a)amd.com> drm/amdgpu: restore UMD profile pstate after runtime resume Myeonghun Pak <mhun512(a)gmail.com> drm/mediatek: ovl_adaptor: balance component registrations Maíra Canal <mcanal(a)igalia.com> drm/vc4: Zero the tile state data array before each BIN job Jose Maria Casanova Crespo <jmcasanova(a)igalia.com> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size Alexander Kaplan <alexander.kaplan(a)sms-medipool.de> drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: mark error-active controller status valid Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: handle bus error interrupts Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: unmap BAR0 using base address Avi Weiss <thnkslprpt(a)gmail.com> can: ctucanfd: use self-test mode for PRESUME_ACK Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ctucanfd: add missing MODULE_DEVICE_TABLE() Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: peak_usb: validate uCAN receive record lengths Maoyi Xie <maoyixie.tju(a)gmail.com> can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error James Gao <jamesgao5(a)outlook.com> can: peak_usb: add bounds check for USB channel index Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: softing: fw_parse(): validate firmware record spans Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents Abdun Nihaal <nihaal(a)cse.iitm.ac.in> can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking Oleksij Rempel <o.rempel(a)pengutronix.de> can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Guangshuo Li <lgs201920130244(a)gmail.com> can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure Pengpeng Hou <pengpeng(a)iscas.ac.cn> can: ems_usb: validate CPC message lengths Lucas Martins Alves <lucas.alves(a)lumal21.com.br> can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured Liem <liem16213(a)gmail.com> i2c: imx: Cancel hrtimer before clearing slave pointer Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling H. Nikolaus Schaller <hns(a)goldelico.com> i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during ct Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix skb leak on flow key update failure during recirculation Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix potential UAF on meter attach failure Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: use read-modify-write for SERDES scrambler bypass Nava kishore Manne <nava.kishore.manne(a)amd.com> phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA ECC private key requests Holger Dengler <dengler(a)linux.ibm.com> s390/zcrypt: Validate length for CCA AES cipher key requests Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Fix undersized format-check buffer Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Fix potential NULL pointer dereference Aswin Karuvally <aswin(a)linux.ibm.com> s390/qeth: Check CAP_NET_ADMIN for private ioctls Xu Rao <raoxu(a)uniontech.com> power: supply: bq25890: fix the -10 C NTC lookup entry Abdun Nihaal <nihaal(a)cse.iitm.ac.in> cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() bui duc phuc <phucduc.bui(a)gmail.com> gpio: pca953x: fix cache_only and IRQ state on restore_context() failure Myeonghun Pak <mhun512(a)gmail.com> i2c: amd-mp2: Unregister callback on adapter add failure Vincent Jardin <vjardin(a)free.fr> hwmon: (pmbus/core) notify on the hwmon device, not the i2c client Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Asim Viladi Oglu Manizada <manizada(a)pm.me> sctp: prevent peer transport count overflow Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: reject stale cookies with mismatched verification tags Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Chris Gellermann <christian.gellermann(a)codasip.com> selftests/clone3: fix wild pointer access of getline due to missing init Chris Gellermann <christian.gellermann(a)codasip.com> selftests/mm: fix potential wild pointer access of getline due to missing init Vijaya Krishna Nivarthi <vijaya.nivarthi(a)oss.qualcomm.com> spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/filters: Fix false positive match in regex_match_full() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Check return value of __register_event() in trace_module_add_events() Ming Lei <tom.leiming(a)gmail.com> ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: use neigh_ha_snapshot() in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: unclone skb head before modifying eth header in route_shortcircuit() Eric Dumazet <edumazet(a)google.com> vxlan: re-fetch eth header after route_shortcircuit() Michael Bommarito <michael.bommarito(a)gmail.com> um: vector: fix use-after-free in vector_mmsg_rx() Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() Zhiling Zou <zhilinz(a)nebusec.ai> net: ipv6: clear suppressed fib6 rule result Zhiling Zou <zhilinz(a)nebusec.ai> net: bridge: stop fast-leave after deleting a port group Link Lin <linkl(a)google.com> mm/page_reporting: use system_freezable_wq to fix UAF during suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: reject a flag character as the field delimiter Zhao Li <enderaoelyther(a)gmail.com> wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Zihan Xi <zihanx(a)nebusec.ai> tipc: avoid use-after-free in poll trace queue dumps David Lee <david.lee(a)trailofbits.com> netfilter: ipset: do not update comments from kernel-side hash adds Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net/smc: fix socket use-after-free during link group termination Zhiling Zou <roxy520tt(a)gmail.com> ipvs: do not propagate one-packet flag to synced conns Matt Vollrath <tactii(a)gmail.com> igbvf: Fix leak in TX DMA error cleanup Dawei Feng <dawei.feng(a)seu.edu.cn> e1000: fix memory leak in e1000_probe() Md Sadre Alam <md.alam(a)oss.qualcomm.com> dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Clamp frame size in implicit-feedback mode Sonali Pradhan <sonalipradhan(a)google.com> ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix use-after-free in ump_to_endpoint() Matt Vollrath <tactii(a)gmail.com> ata: libata-eh: Increase STANDBY IMMEDIATE timeout Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix broken entries in the volume lookup table Haidar Lee <haidar.lee(a)adlinktech.com> ASoC: tas2562: fix DVC coefficient write order Baul Lee <baul.lee(a)xbow.com> ALSA: ump: fix double free of out_cvts on rawmidi error Norbert Szetei <norbert(a)doyensec.com> ALSA: pcm: wake linked drain waiters on unlink Xu Rao <raoxu(a)uniontech.com> ALSA: lx6464es: fix period byte count for 16-bit streams Takashi Iwai <tiwai(a)suse.de> ALSA: 6fire: Fix UAF at error handling during probe Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> bpf: lwt: Fix dst reference leak on reroute failure Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: validate numbered report payloads Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Luxiao Xu <rakukuip(a)gmail.com> audit: fix potential use-after-free in audit_del_rule() Zhan Xusheng <zhanxusheng1024(a)gmail.com> audit: fix potential integer overflow in audit_log_n_string() Charles Vosburgh <trilobyte777(a)gmail.com> sctp: validate Adaptation Indication parameter length Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Validate AIBV and AISB before pinning guest pages Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix NULL dereference on AIBV allocation failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Reject adapter interrupt forwarding if already enabled Sean Christopherson <seanjc(a)google.com> KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Raushan Patel <raushan.jhon(a)gmail.com> tracing/probes: Reject $arg0 in meta argument expansion Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Xiangfeng Cai <caixiangfeng(a)bytedance.com> mm/hugetlb: fix list corruption in allocate_file_region_entries() Zi Yan <ziy(a)nvidia.com> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() Benjamin Boortz <bennib(a)mailbox.org> pinctrl: bm1880: add missing select GENERIC_PINCONF Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Karl Mehltretter <kmehltretter(a)gmail.com> pinctrl: devicetree: don't free uninitialized dev_name on error path Benjamin Boortz <bennib(a)mailbox.org> pinctrl: microchip-sgpio: add missing select REGMAP_MMIO Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Pengfei Zhang <zhangfeionline(a)gmail.com> ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __close_file_table_ids() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: return success for deferred final close Denis V. Lunev <den(a)openvz.org> qede: sync udp_tunnel ports outside qede_lock in the recovery path Suman Ghosh <sumang(a)marvell.com> octeontx2-pf: Set correct sequence for carrier off and tx queue stop Daniel Golle <daniel(a)makrotopia.org> net: dsa: mt7530: error out on failed reads in MT7531 PHY polling Muhammad Bilal <meatuni001(a)gmail.com> accel/qaic: use sizeof(*trans_hdr) for transaction length check Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/mmiotrace: Reset dropped_count in mmio_reset_data() Minhong He <heminhong(a)kylinos.cn> can: isotp: check register_netdevice_notifier() error in module init Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: check descriptor ring allocation failures Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: sxgbe: free TX rings on RX allocation failure Leon Romanovsky <leon(a)kernel.org> scsi: target: Clear cmd_cnt when initial counter enrollment fails Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req Guangshuo Li <lgs201920130244(a)gmail.com> scsi: ufs: core: Cancel RTC work in active-active suspend TanZheng <tanzheng(a)kylinos.cn> scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE Christian Marangi <ansuelsmth(a)gmail.com> net: phylink: put link_gpio if phylink_create fails Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: btintel: Validate length before parsing diagnostics TLV Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Jiale Yao <yaojiale02(a)163.com> Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: clear iso_data always when detaching conn from hcon Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: validate individual TWT params before driver setup Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-akebono CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix treeboot-currituck CPU node lookup check Thorsten Blum <thorsten.blum(a)linux.dev> powerpc/boot: Fix simpleboot CPU node lookup check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix PWM auto temp state array and bounds check Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Use cached PWM frequency value Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix cache updated before hardware write on I2C error Luiz Angelo Daros de Luca <luizluca(a)gmail.com> hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors Chenguang Zhao <zhaochenguang(a)kylinos.cn> forcedeth: fix UAF of txrx_stats in nv_remove David Corvaglia <david(a)corvaglia.dev> net: bridge: mrp: fix Option TLV length in MRP_Test frames Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Prevent access to unsupported weight registers Eric Dumazet <edumazet(a)google.com> net: do not send ICMP/NDISC Redirects when peer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) DMA-align output buffer Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Only report alarms if driver is ready Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: spi-cadence: Move TX FIFO full busy-wait into FIFO Jun Guo <jun.guo(a)cixtech.com> spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 Dawei Feng <dawei.feng(a)seu.edu.cn> smb: client: fix buffer leaks in SMB1 read and write Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer HyeongJun An <sammiee5311(a)gmail.com> scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer Mario Limonciello <mario.limonciello(a)amd.com> pinctrl-amd: Don't clear S4 wake bits at probe Xiang Mei <xmei5(a)asu.edu> rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: nft_payload: fix mask build for partial field offload Julian Anastasov <ja(a)ssi.bg> ipvs: do not mangle ICMP replies for non-first fragments Julian Anastasov <ja(a)ssi.bg> ipvs: fix places with wrong packet offsets Julian Anastasov <ja(a)ssi.bg> ipvs: fix the checksum validations Kent Overstreet <kent.overstreet(a)gmail.com> sched: Add task_struct->faults_disabled_mapping Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Michael Bommarito <michael.bommarito(a)gmail.com> assoc_array: trim the final shortcut word using the current chunk end Michael Bommarito <michael.bommarito(a)gmail.com> keys: make keyring key-chunk byte order agree with keyring_diff_objects() Michael Bommarito <michael.bommarito(a)gmail.com> keys: fix out-of-bounds read in keyring_get_key_chunk() Ruoyu Wang <ruoyuw560(a)gmail.com> drm/mediatek: Check CRTC state before freeing Xiang Mei <xmei5(a)asu.edu> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix runtime PM leak on probe allocation failure Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> phy: zynqmp: fix clock error handling in xpsgtr_phy_init() Mike Looijmans <mike.looijmans(a)topic.nl> phy-zynqmp: Postpone getting clock rate until actually needed Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: fix deadlock between metadata writeback and transaction commit Uday Khare <udaykhare77(a)gmail.com> ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup Uday Khare <udaykhare77(a)gmail.com> ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() Damien Le Moal <dlemoal(a)kernel.org> ahci: Introduce ahci_ignore_port() helper Josua Mayer <josua(a)solid-run.com> ata: libahci_platform: support non-consecutive port numbers Rosen Penev <rosenp(a)gmail.com> ata: sata_mv: accept 1 or 2 resources in platform probe Yuho Choi <dbgh9129(a)gmail.com> dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() Hongling Zeng <zenghongling(a)kylinos.cn> dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Harshal Dev <harshal.dev(a)oss.qualcomm.com> soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Benjamin Tissoires <bentiss(a)kernel.org> HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report Lee Jones <lee(a)kernel.org> HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write Lee Jones <lee(a)kernel.org> HID: logitech-dj: Standardise hid_report_enum variable nomenclature Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: mpls: initialize rtm_tos in mpls_getroute() Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_expect: restore helper propagation via expectation ------------- Diffstat: Makefile | 4 +- arch/powerpc/boot/simpleboot.c | 2 +- arch/powerpc/boot/treeboot-akebono.c | 2 +- arch/powerpc/boot/treeboot-currituck.c | 2 +- arch/powerpc/platforms/ps3/mm.c | 1 + arch/s390/kvm/pci.c | 28 +- arch/um/drivers/vector_kern.c | 3 + arch/x86/kvm/svm/avic.c | 8 - drivers/accel/qaic/qaic_control.c | 2 +- drivers/ata/ahci.h | 17 +- drivers/ata/ahci_brcm.c | 3 + drivers/ata/ahci_ceva.c | 24 +- drivers/ata/libahci.c | 1 + drivers/ata/libahci_platform.c | 38 +- drivers/ata/libata-eh.c | 8 + drivers/ata/sata_mv.c | 2 +- drivers/block/ublk_drv.c | 9 + drivers/bluetooth/btintel.c | 3 + drivers/bluetooth/btmtk.c | 50 +- drivers/cpufreq/ia64-acpi-cpufreq.c | 4 +- drivers/cpufreq/powernow-k8.c | 1 + drivers/dma/idxd/cdev.c | 4 +- drivers/dma/sun6i-dma.c | 11 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/gpio/gpio-pca953x.c | 15 +- drivers/gpio/gpio-pch.c | 28 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 12 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 23 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- drivers/gpu/drm/armada/armada_fbdev.c | 12 +- drivers/gpu/drm/display/drm_dp_helper.c | 12 + drivers/gpu/drm/drm_fb_helper.c | 41 +- drivers/gpu/drm/drm_fbdev_dma.c | 12 +- drivers/gpu/drm/drm_fbdev_generic.c | 12 +- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +- drivers/gpu/drm/gma500/fbdev.c | 13 +- drivers/gpu/drm/i915/display/intel_display_core.h | 3 + .../gpu/drm/i915/display/intel_display_device.c | 3 + drivers/gpu/drm/i915/display/intel_display_types.h | 40 ++ drivers/gpu/drm/i915/display/intel_fbc.c | 9 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 266 ++++---- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 7 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 6 +- drivers/gpu/drm/msm/msm_fbdev.c | 9 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +- drivers/gpu/drm/renesas/Kconfig | 1 + drivers/gpu/drm/renesas/Makefile | 1 + drivers/gpu/drm/renesas/rcar-du/Kconfig | 8 - drivers/gpu/drm/renesas/rcar-du/Makefile | 2 - drivers/gpu/drm/renesas/rz-du/Kconfig | 8 + drivers/gpu/drm/renesas/rz-du/Makefile | 3 + .../renesas/{rcar-du => rz-du}/rzg2l_mipi_dsi.c | 2 +- .../{rcar-du => rz-du}/rzg2l_mipi_dsi_regs.h | 0 drivers/gpu/drm/tegra/fbdev.c | 18 +- drivers/gpu/drm/vc4/vc4_irq.c | 2 +- drivers/gpu/drm/vc4/vc4_validate.c | 29 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 39 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 13 +- drivers/hid/hid-logitech-dj.c | 28 +- drivers/hwmon/adt7470.c | 131 ++-- drivers/hwmon/lm90.c | 4 +- drivers/hwmon/nct6775-core.c | 20 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/pmbus/pmbus_core.c | 7 +- drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +- drivers/i2c/busses/i2c-imx.c | 9 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/iommu/iommu-sva.c | 6 +- drivers/media/i2c/imx219.c | 670 ++++++++++--------- drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/net/can/c_can/c_can_main.c | 8 +- drivers/net/can/ctucanfd/ctucanfd_base.c | 14 +- drivers/net/can/ctucanfd/ctucanfd_pci.c | 3 +- drivers/net/can/dev/skb.c | 2 - drivers/net/can/softing/softing_fw.c | 46 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 13 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 40 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 20 +- drivers/net/dsa/mt7530.c | 58 +- drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_main.c | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 33 + drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/igbvf/netdev.c | 2 - .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 44 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 14 +- drivers/net/phy/phylink.c | 29 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 15 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + .../broadcom/brcm80211/include/brcm_hw_ids.h | 2 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 130 ++-- drivers/pinctrl/Kconfig | 2 + drivers/pinctrl/devicetree.c | 4 + drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 21 +- drivers/power/supply/bq25890_charger.c | 2 +- drivers/s390/block/dasd_eckd.c | 11 +- drivers/s390/block/dasd_ioctl.c | 2 +- drivers/s390/crypto/zcrypt_api.c | 2 +- drivers/s390/crypto/zcrypt_ccamisc.c | 6 + drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/scsi/zfcp_aux.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libiscsi.c | 2 +- drivers/scsi/libiscsi_tcp.c | 8 +- drivers/scsi/libsas/sas_init.c | 37 +- drivers/scsi/scsi_debug.c | 8 +- drivers/soc/qcom/ice.c | 17 +- drivers/spi/spi-cadence.c | 129 +++- drivers/spi/spi-qcom-qspi.c | 3 +- drivers/target/target_core_iblock.c | 6 +- drivers/target/target_core_transport.c | 12 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/usb/gadget/function/f_tcm.c | 192 +++++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/typec/ucsi/ucsi.c | 113 ++-- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/binfmt_misc.c | 4 + fs/btrfs/zoned.c | 6 +- fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 279 ++++---- fs/ceph/caps.c | 708 ++++++++++++--------- fs/ceph/crypto.c | 39 +- fs/ceph/debugfs.c | 6 +- fs/ceph/dir.c | 225 ++++--- fs/ceph/export.c | 39 +- fs/ceph/file.c | 245 ++++--- fs/ceph/inode.c | 485 +++++++------- fs/ceph/ioctl.c | 13 +- fs/ceph/locks.c | 57 +- fs/ceph/mds_client.c | 554 +++++++++------- fs/ceph/mdsmap.c | 24 +- fs/ceph/metric.c | 5 +- fs/ceph/quota.c | 29 +- fs/ceph/snap.c | 174 ++--- fs/ceph/super.c | 70 +- fs/ceph/super.h | 6 + fs/ceph/xattr.c | 96 +-- fs/erofs/Kconfig | 14 + fs/erofs/decompressor_lzma.c | 3 +- fs/smb/client/cifssmb.c | 12 +- fs/smb/server/vfs_cache.c | 6 +- include/drm/drm_fb_helper.h | 12 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma/qcom_bam_dma.h | 21 +- include/linux/libata.h | 2 +- include/linux/mmc/sdio_ids.h | 2 +- include/linux/netfilter/nf_conntrack_sip.h | 2 +- include/linux/sched.h | 1 + include/linux/sysctl.h | 2 +- include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 8 +- include/net/ip_vs.h | 45 +- include/net/neighbour.h | 8 +- include/net/netfilter/nf_conntrack_expect.h | 5 +- include/net/netfilter/nf_tables.h | 2 + include/scsi/libsas.h | 1 - init/init_task.c | 1 + ipc/ipc_sysctl.c | 2 +- ipc/mq_sysctl.c | 2 +- kernel/audit.c | 11 +- kernel/auditfilter.c | 6 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_mmiotrace.c | 1 + kernel/trace/trace_probe.c | 6 +- kernel/ucount.c | 2 +- lib/assoc_array.c | 3 +- lib/rhashtable.c | 1 + mm/huge_memory.c | 16 +- mm/hugetlb.c | 12 +- mm/mm_init.c | 15 +- mm/page_reporting.c | 6 +- mm/percpu-km.c | 2 +- net/ax25/sysctl_net_ax25.c | 2 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_sync.c | 19 +- net/bluetooth/hidp/core.c | 30 +- net/bluetooth/iso.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 84 ++- net/bridge/br_mrp.c | 2 +- net/bridge/br_multicast.c | 1 + net/bridge/br_netfilter_hooks.c | 8 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 337 +++++++--- net/can/j1939/bus.c | 2 + net/can/j1939/j1939-priv.h | 3 + net/can/j1939/main.c | 8 +- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 6 +- net/can/raw.c | 7 +- net/core/lwt_bpf.c | 4 +- net/core/sysctl_net_core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/devinet.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/route.c | 4 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/xfrm4_policy.c | 2 +- net/ipv6/addrconf.c | 2 +- net/ipv6/fib6_rules.c | 1 + net/ipv6/ip6_fib.c | 17 +- net/ipv6/ip6_output.c | 2 +- net/ipv6/ndisc.c | 2 + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/reassembly.c | 2 +- net/ipv6/sysctl_net_ipv6.c | 6 +- net/ipv6/xfrm6_policy.c | 2 +- net/mac80211/s1g.c | 4 + net/mpls/af_mpls.c | 5 +- net/mptcp/ctrl.c | 2 +- net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 ++- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipvs/ip_vs_app.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 3 + net/netfilter/ipvs/ip_vs_core.c | 180 +++--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 54 +- net/netfilter/ipvs/ip_vs_xmit.c | 42 +- net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nf_conntrack_expect.c | 1 + net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 5 + net/netfilter/nf_conntrack_netlink.c | 18 +- net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_log.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- net/netfilter/nf_tables_api.c | 10 +- net/netfilter/nft_payload.c | 12 +- net/netfilter/nft_set_pipapo.c | 11 +- net/netfilter/xt_hashlimit.c | 16 +- net/openvswitch/actions.c | 12 +- net/openvswitch/meter.c | 33 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/tcp.c | 14 +- net/rxrpc/ar-internal.h | 1 + net/rxrpc/call_accept.c | 1 + net/rxrpc/peer_object.c | 12 +- net/sctp/associola.c | 3 + net/sctp/protocol.c | 21 +- net/sctp/sm_make_chunk.c | 17 +- net/sctp/sysctl.c | 11 +- net/smc/smc_core.c | 2 +- net/smc/smc_sysctl.c | 2 +- net/tipc/socket.c | 2 +- net/unix/sysctl_net_unix.c | 2 +- net/xfrm/xfrm_sysctl.c | 2 +- security/keys/keyring.c | 14 +- sound/core/pcm_native.c | 7 + sound/core/ump.c | 1 + sound/pci/hda/patch_hdmi.c | 48 +- sound/pci/lx6464es/lx6464es.c | 5 +- sound/pci/lx6464es/lx_core.c | 5 +- sound/soc/codecs/max98090.c | 5 +- sound/soc/codecs/max98095.c | 5 +- sound/soc/codecs/tas2562.c | 30 +- sound/usb/6fire/chip.c | 4 + sound/usb/endpoint.c | 14 +- sound/usb/midi.c | 2 + sound/usb/midi2.c | 4 +- tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- tools/testing/selftests/mm/mlock-random-test.c | 2 +- 305 files changed, 4972 insertions(+), 3146 deletions(-)

1 month

ISE 2026 Attendees List 40% Off

by Alyssa Grant

Hi, We have the Integrated Systems Europe 2026 visitor database with 95,930 verified contacts available. 100% Opt-in & GDPR Compliant. Whether you're looking for the full attendee list or a specific audience segment, I'll be happy to share the available contact counts, sample records, and pricing. Q3 Promo: Enjoy 40% Off Kind regards, Alyssa Grant Sr. Demand Generation

1 month

当たり前を疑う。社長のNG行動

by ナレッジリンク

　　　お世話になります。ナレッジリンクセミナー事務局です。　　・社員のモチベーションを上げようと声をかける　・現場のトラブルに、自ら先頭に立って対応する　　もし、社長がこれらを率先しているようであれば　残念ながら、その組織の成長はそこで止まります。　　社長の“優しさ”が、社員の甘えを生み、責任感を奪い　「指示待ち人間」を量産する装置になっているからです。　　　4,800社の経営者が衝撃を受けた、　良かれと思ってやってしまう「社長のNG行動」の正体。　　組織を劇的に変えるためのウェビナーです。　　1つでも心当たりがあれば、一度ご視聴ください。　　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　 ---------------------------------------------- 　　テーマ：　それ、危険です『社長のNG行動』　　　　　〜その行動が、組織崩壊を招く〜　　日程　：8月18日（火）13:00スタート　　　　　※どちらの日程も内容は同じ　会場　：Zoom開催　定員　：先着100名（費用は不要） ---------------------------------------------- 　※経営層の方限定です　　　なぜ、社員は「言われたこと」しかやらないのか。　なぜ、次世代のリーダー候補が育たないのか。　　それは、能力の問題ではなく、　　良かれと思って続けている「社長の配慮」こそが、　組織成長を止める、最大のボトルネックかもしれません。　　本セミナーでは、4,800社以上が導入した　独自の組織論「識学」に基づき、社長の「NG行動」と　真の経営者へ脱皮するためのマインドセットを伝授します。　　　【セミナー内容(一部抜粋)】　 ○ NG行動3選　 ○ なぜ優秀なNo.2や部長が育たないのか　 ○ マネジメントスタイルの変革について　 ○ 導入企業の事例　　「管理職が育ったら任せる」ではなく「任せるから育つ」　という思考の逆転を提言。　　現場から「冷たくなった」と思われることを恐れず　機能的な階層構造を作ることで　結果として社員全員を守り　利益を最大化させる道筋を明示します。　「優しさ」で人を動かすのではなく　「正しさ」で組織を動かす。　音声やお顔が表に出ることはございませんので　お気軽にご視聴ください。　　>>視聴予約はこちら　https://knowledge-corp.jp/shikigaku5/ 　　 ----------------------- 　一般社団法人ナレッジリンク　東京都千代田区神田小川町1-8-3 　電話：03-5256-7638 　セミナーのご案内が不要な方は大変残念ではございますが、　下記URLより手続き下さいませ。　　メール配信のワンクリック解除はこちら　https://fc-knowledgelink-corp.jp/mail/ 　

1 month, 1 week

[PATCH 6.6 000/484] 6.6.148-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.148 release. There are 484 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:41 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.148-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.148-rc1 Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug David Howells <dhowells(a)redhat.com> rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Julien Massot <julien.massot(a)collabora.com> ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() Chen-Yu Tsai <wenst(a)chromium.org> ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Qian Zuo <zuoqian113(a)gmail.com> coredump: fix pidfs file refcount leak in umh_coredump_setup Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Théo Lebrun <theo.lebrun(a)bootlin.com> net: macb: drop in-flight Tx SKBs on close Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Wentao Liang <vulab(a)iscas.ac.cn> ipmi: fix refcount leak in i_ipmi_request() Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Sergio Paracuellos <sergio.paracuellos(a)gmail.com> gpio: mt7621: avoid corruption of shared interrupt trigger state Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> pinctrl: remove pinctrl_gpio_direction_output() Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Michael Bommarito <michael.bommarito(a)gmail.com> tracing/user_events: Fix use-after-free in user_event_mm_dup() Marco Crivellari <marco.crivellari(a)suse.com> workqueue: Add system_percpu_wq and system_dfl_wq Tejun Heo <tj(a)kernel.org> workqueue: Factor out init_cpu_worker_pool() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: avoid double increment of &use_bh_wq_enabled Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Benjamin Coddington <ben.coddington(a)hammerspace.com> NFS: Charge unstable writes by request size, not folio size Christoph Hellwig <hch(a)lst.de> nfs: remove dead code for the old swap over NFS implementation Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> platform/x86: dell-laptop: fix missing cleanups in init error path Lyndon Sanche <lsanche(a)lyndeno.ca> platform/x86: dell-smbios: Move request functions for reuse Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> thunderbolt: Update property.c function documentation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> thunderbolt: Remove usage of the deprecated ida_simple_xx() API Gil Fine <gil.fine(a)linux.intel.com> thunderbolt: Handle lane bonding of Gen 4 XDomain links properly Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma-pcie: Reject devices without driver data Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> dmaengine: dw-edma: Fix confusing cleanup.h syntax Abinash Singh <abinashlalotra(a)gmail.com> dma: dw-edma: Fix build warning in dw_edma_pcie_probe() Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Pause continuous reads at block boundaries Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Ensure all continuous terms are always in sync Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Add a helper for calculating a page index Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Muchun Song <muchun.song(a)linux.dev> mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Jeff Layton <jlayton(a)kernel.org> sunrpc: allocate a separate bvec array for socket sends Mike Snitzer <snitzer(a)kernel.org> NFSD: pass nfsd_file to nfsd_iter_read() Theodor Arsenij Larionov-Trichkine <theodorlarionov(a)gmail.com> netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: remove register tracking infrastructure Yue Haibing <yuehaibing(a)huawei.com> netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link Abdun Nihaal <nihaal(a)cse.iitm.ac.in> fbdev: efifb: fix memory leak in efifb_probe() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/efifb: Replace references to global screen_info by local pointer Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Use irq-disabling spinlocks between app and I/O thread David Howells <dhowells(a)redhat.com> rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown David Howells <dhowells(a)redhat.com> rxrpc: Pull out certain app callback funcs into an ops table David Howells <dhowells(a)redhat.com> afs: Turn the afs_addr_list address array into an array of structs Kees Cook <keescook(a)chromium.org> afs: Annotate struct afs_addr_list with __counted_by Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Wentao Guan <guanwentao(a)uniontech.com> bpf: drop bpf_lsm_getselfattr from hook list Coia Prant <coiaprant(a)gmail.com> net: pcs: xpcs: fix SGMII state reading Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources Namjae Jeon <linkinjeon(a)kernel.org> exfat: validate cluster allocation bits of the allocation bitmap Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate ACE size against SID sub-authorities Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Weiming Shi <bestswngs(a)gmail.com> ipv6: ndisc: fix NULL deref in accept_untracked_na() Jacob Keller <jacob.e.keller(a)intel.com> i40e: remove read access to debugfs files Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture mapping leak Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho <luciano.coelho(a)intel.com> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled James Raphael Tiovalen <jamestiotio(a)gmail.com> vxlan: mdb: Fix source list corruption on a failed replace Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov <security(a)auditcode.ai> mac802154: hold an interface reference across the scan worker Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Reset triggers at top level before instance loop Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein <amir73il(a)gmail.com> fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann <max.kellermann(a)ionos.com> ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Haoran Jiang <jianghaoran(a)kylinos.cn> LoongArch: Fix oops during single-step debugging Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: set new_stream to NULL after release Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Thomas Zimmermann <tzimmermann(a)suse.de> drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Junrui Luo <moonafterrain(a)outlook.com> drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Marcin Szycik <marcin.szycik(a)linux.intel.com> ice: fix LAG recipe to profile association Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Qingfang Deng <dqfext(a)gmail.com> ppp: enable TX scatter-gather Qingfang Deng <dqfext(a)gmail.com> ppp: convert to percpu netstats Qingfang Deng <dqfext(a)gmail.com> ppp: use IFF_NO_QUEUE in virtual interfaces Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation vadik likholetov <vadikas(a)gmail.com> net: stmmac: enable the MAC on link up for all supported speeds Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Zhang Yi <yi.zhang(a)huawei.com> iomap: correct the range of a partial dirty clear Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Michael Walle <mwalle(a)kernel.org> net: dpaa: fix mode setting Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Kuniyuki Iwashima <kuniyu(a)amazon.com> selftest: af_unix: Add Kconfig file. Rishikesh Jethwani <rjethwani(a)purestorage.com> tls: device: push pending open record on splice EOF Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: check for workqueue allocation failure Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix auxiliary device add/del races Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: order completion reads after the ownership check Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: yield the CPU while waiting for the adminq to drain HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: reject component parameter in legacy firmware update Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: tear down new links on vif update error path Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: validate Realtek vendor event length Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: validate SAR GEO response payload size Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use complete_all() to signal init_completion Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix potential probe() deadlock Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Don't use devres to unregister component Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Pengpeng Hou <pengpeng(a)iscas.ac.cn> ASoC: tas2781: bound firmware description string parsing Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Qihang <q.h.hack.winter(a)gmail.com> ksmbd: pin conn during async oplock break notification Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Alexander Gordeev <agordeev(a)linux.ibm.com> sched/vtime: Get rid of generic vtime_task_switch() implementation Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Ruoyu Wang <ruoyuw560(a)gmail.com> Bluetooth: hci_qca: Clear memdump state on invalid dump size Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: use platform_get_irq() Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: cs42l43: Correct report for forced microphone jack Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Xue Lei <Xue.Lei(a)windriver.com> mtd: fix double free and WARN_ON in add_mtd_device() error paths Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Guoqing Jiang <guoqing.jiang(a)linux.dev> RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent rereg_mr for non-mem regions Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add helpers for umem dmabuf revoke lock Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add pinned revocable dmabuf import interface Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Move umem dmabuf revoke logic into helper function Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Yishai Hadas <yishaih(a)nvidia.com> RDMA/umem: Introduce an option to revoke DMABUF umem Yishai Hadas <yishaih(a)nvidia.com> RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Jhonraushan <raushan.jhon(a)gmail.com> accel/ivpu: Reject firmware log with size smaller than header Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Allow KASAN to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Cure some more scoped_seqlock() optimization fails Daniel Gibson <daniel(a)gibson.sh> platform/x86/amd/pmc: Avoid logging "(null)" for DMI values Daniel Gibson <daniel(a)gibson.sh> platform/x86/amd/pmc: Don't log during intermediate wakeups Ryosuke Yasuoka <ryasuoka(a)redhat.com> drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/kvm/arm.c | 2 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/mips/kvm/mips.c | 2 +- arch/powerpc/include/asm/cputime.h | 13 - arch/powerpc/kernel/time.c | 65 +++ arch/powerpc/kvm/powerpc.c | 2 +- arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kvm/aia.c | 35 +- arch/riscv/kvm/vcpu.c | 66 ++- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/kvm/x86.c | 4 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/accel/ivpu/ivpu_fw_log.c | 4 + drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-pcie.c | 63 +-- drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_bo.c | 10 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/core/umem_dmabuf.c | 176 ++++++- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 7 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/misc/ims-pcu.c | 37 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 25 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/md/dm-verity-target.c | 14 +- drivers/md/dm-verity.h | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + drivers/media/platform/marvell/cafe-driver.c | 1 + .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/mtd/nand/raw/nand_base.c | 43 +- drivers/net/amt.c | 87 +++- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 1 + drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 9 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +---- drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 28 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 ++-- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/geneve.c | 3 + drivers/net/gtp.c | 5 +- drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/ppp/ppp_generic.c | 154 +++--- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 14 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 4 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/platform/loongarch/loongson-laptop.c | 1 + drivers/platform/x86/amd/pmc/pmc.c | 39 +- drivers/platform/x86/amd/pmc/pmc.h | 1 + drivers/platform/x86/dell/dell-laptop.c | 28 +- drivers/platform/x86/dell/dell-smbios-base.c | 25 + drivers/platform/x86/dell/dell-smbios.h | 5 + .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 61 ++- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 149 ++++-- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vdpa/vdpa_user/iova_domain.c | 161 ++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 ++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 +++--- drivers/video/fbdev/core/fbcon_cw.c | 148 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- drivers/video/fbdev/efifb.c | 125 ++--- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/addr_list.c | 10 +- fs/afs/fs_probe.c | 6 +- fs/afs/internal.h | 6 +- fs/afs/proc.c | 4 +- fs/afs/rotate.c | 2 +- fs/afs/rxrpc.c | 15 +- fs/afs/server.c | 4 +- fs/afs/vl_alias.c | 4 +- fs/afs/vl_probe.c | 6 +- fs/afs/vl_rotate.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/ceph/ioctl.c | 6 + fs/coredump.c | 1 + fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/exfat/balloc.c | 54 ++- fs/f2fs/super.c | 25 +- fs/iomap/buffered-io.c | 12 +- fs/namei.c | 43 ++ fs/nfs/internal.h | 16 +- fs/nfs/pnfs_nfs.c | 2 +- fs/nfs/write.c | 14 +- fs/nfsd/nfs4xdr.c | 8 +- fs/nfsd/vfs.c | 7 +- fs/nfsd/vfs.h | 2 +- fs/overlayfs/copy_up.c | 12 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/smb/client/misc.c | 34 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smbacl.c | 42 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/firmware.h | 3 + include/linux/fscrypt.h | 18 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/ppp_channel.h | 3 +- include/linux/seqlock.h | 10 +- include/linux/sunrpc/svcsock.h | 3 + include/linux/sunrpc/xdr.h | 19 +- include/linux/vtime.h | 6 + include/linux/workqueue.h | 8 +- include/media/videobuf2-core.h | 8 +- include/net/af_rxrpc.h | 25 +- include/net/bluetooth/rfcomm.h | 3 + include/net/netfilter/nf_tables.h | 37 -- include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 3 - include/net/sctp/structs.h | 3 +- include/rdma/ib_umem.h | 41 ++ include/trace/events/rxrpc.h | 3 +- include/uapi/linux/btrfs.h | 2 +- init/main.c | 39 -- io_uring/rw.c | 28 +- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/verifier.c | 17 + kernel/locking/spinlock_rt.c | 27 +- kernel/sched/cputime.c | 13 - kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 13 + kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events_user.c | 43 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- kernel/workqueue.c | 46 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/damon/core.c | 13 + mm/mm_init.c | 34 +- net/bluetooth/hci_sync.c | 13 +- net/bluetooth/mgmt.c | 42 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/nft_meta_bridge.c | 20 - net/bridge/netfilter/nft_reject_bridge.c | 1 - net/can/bcm.c | 528 +++++++++++++++------ net/can/isotp.c | 278 ++++++++--- net/can/j1939/transport.c | 18 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/netfilter/nft_dup_ipv4.c | 1 - net/ipv4/netfilter/nft_fib_ipv4.c | 2 - net/ipv4/netfilter/nft_reject_ipv4.c | 1 - net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_tunnel.c | 3 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nft_dup_ipv6.c | 1 - net/ipv6/netfilter/nft_fib_ipv6.c | 2 - net/ipv6/netfilter/nft_reject_ipv6.c | 1 - net/ipv6/raw.c | 2 +- net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/rx.c | 2 + net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mpls/af_mpls.c | 3 + net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_tables_api.c | 67 --- net/netfilter/nft_bitwise.c | 104 ---- net/netfilter/nft_byteorder.c | 11 - net/netfilter/nft_cmp.c | 3 - net/netfilter/nft_compat.c | 10 - net/netfilter/nft_connlimit.c | 1 - net/netfilter/nft_counter.c | 1 - net/netfilter/nft_ct.c | 46 -- net/netfilter/nft_dup_netdev.c | 1 - net/netfilter/nft_dynset.c | 1 - net/netfilter/nft_exthdr.c | 34 -- net/netfilter/nft_fib.c | 51 +- net/netfilter/nft_fib_inet.c | 1 - net/netfilter/nft_fib_netdev.c | 30 +- net/netfilter/nft_flow_offload.c | 1 - net/netfilter/nft_fwd_netdev.c | 2 - net/netfilter/nft_hash.c | 36 -- net/netfilter/nft_immediate.c | 12 - net/netfilter/nft_last.c | 1 - net/netfilter/nft_limit.c | 2 - net/netfilter/nft_log.c | 1 - net/netfilter/nft_lookup.c | 12 - net/netfilter/nft_masq.c | 3 - net/netfilter/nft_meta.c | 45 -- net/netfilter/nft_nat.c | 2 - net/netfilter/nft_numgen.c | 22 - net/netfilter/nft_objref.c | 2 - net/netfilter/nft_osf.c | 25 - net/netfilter/nft_payload.c | 47 -- net/netfilter/nft_queue.c | 2 - net/netfilter/nft_quota.c | 1 - net/netfilter/nft_range.c | 1 - net/netfilter/nft_redir.c | 3 - net/netfilter/nft_reject_inet.c | 1 - net/netfilter/nft_reject_netdev.c | 1 - net/netfilter/nft_rt.c | 1 - net/netfilter/nft_set_pipapo.c | 259 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 26 - net/netfilter/nft_synproxy.c | 1 - net/netfilter/nft_tproxy.c | 1 - net/netfilter/nft_tunnel.c | 26 - net/netfilter/nft_xfrm.c | 27 -- net/openvswitch/actions.c | 15 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/recv.c | 15 + net/rxrpc/af_rxrpc.c | 24 +- net/rxrpc/ar-internal.h | 3 +- net/rxrpc/call_accept.c | 77 +-- net/rxrpc/call_object.c | 42 +- net/rxrpc/conn_client.c | 12 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/conn_object.c | 8 +- net/rxrpc/input.c | 5 +- net/rxrpc/io_thread.c | 8 +- net/rxrpc/peer_event.c | 8 +- net/rxrpc/peer_object.c | 1 + net/rxrpc/recvmsg.c | 26 +- net/rxrpc/rxperf.c | 10 +- net/rxrpc/security.c | 4 +- net/rxrpc/sendmsg.c | 8 +- net/rxrpc/txbuf.c | 4 +- net/sched/act_tunnel_key.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sunrpc/svcsock.c | 51 +- net/sunrpc/xdr.c | 210 +++++++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 7 +- net/tls/tls_device.c | 6 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 20 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 4 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 36 +- security/selinux/hooks.c | 99 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++- security/smack/smack_netfilter.c | 4 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 25 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 ++- sound/soc/mediatek/mt6797/mt6797-afe-pcm.c | 14 +- sound/soc/mediatek/mt7986/mt7986-afe-pcm.c | 14 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 26 +- sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 21 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 135 ++---- sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 54 +-- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 38 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/quirks.c | 2 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++ tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/af_unix/config | 4 + tools/testing/selftests/net/openvswitch/config | 16 + virt/kvm/kvm_main.c | 3 + 561 files changed, 6388 insertions(+), 4060 deletions(-)

1 month, 1 week

[PATCH 7.1 000/744] 7.1.6-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.6 release. There are 744 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:38 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.6-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.6-rc1 Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug Willem de Bruijn <willemb(a)google.com> selftests: drv-net: so_txtime: relax variance bounds Willem de Bruijn <willemb(a)google.com> selftests: drv-net: cope with slow env in so_txtime.py test Andrea Righi <arighi(a)nvidia.com> sched_ext: Preserve rq tracking across local DSQ dispatch Tejun Heo <tj(a)kernel.org> sched_ext: Move shared helpers from ext.c into internal.h and cid.h Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Shradha Gupta <shradhagupta(a)linux.microsoft.com> net: mana: Optimize irq affinity for low vcpu configs Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Muchun Song <muchun.song(a)linux.dev> mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization Muchun Song <muchun.song(a)linux.dev> mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Darrick J. Wong <djwong(a)kernel.org> xfs: don't replace the wrong part of the cow fork Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix race between registration and connection abortion Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate ACE size against SID sub-authorities Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: drv-net: add missing kconfig for psp.py Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit range calculation Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture mapping leak Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: reject mapping a reserved doorbell to a new queue Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Ce Sun <cesun102(a)amd.com> drm/amdgpu: fix resource leak on ACP reset timeout Harish Kasiviswanathan <Harish.Kasiviswanathan(a)amd.com> drm/amdgpu: Fix kernel panic during driver load failure Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho <luciano.coelho(a)intel.com> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu/mes11: set doorbell offset for suspending userq Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix amdgpu_pm_info power display units Ethan Nelson-Moore <enelsonmoore(a)gmail.com> watchdog: s32g_wdt: remove incorrect options in watchdog_info struct James Raphael Tiovalen <jamestiotio(a)gmail.com> vxlan: mdb: Fix source list corruption on a failed replace Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: collapse receive queue under memory pressure Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> tcp: initialize standalone TCP-AO response padding Justin Lai <justinlai0215(a)realtek.com> rtase: Workaround for TX hang caused by hardware packet parsing Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Shuvam Pandey <shuvampandey1(a)gmail.com> ovpn: hold peer before scheduling keepalive work Pavitra Jha <jhapavitra98(a)gmail.com> ovpn: fix peer refcount leak in TCP error paths Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov <security(a)auditcode.ai> mac802154: hold an interface reference across the scan worker Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ice: reject out-of-range ptype in ice_parser_profile_init Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Carl Johnson <carl(a)jpartners.org> smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Reset triggers at top level before instance loop Paul Greenwalt <paul.greenwalt(a)intel.com> ice: fix PTP Call Trace during PTP release Sven Schnelle <svens(a)linux.ibm.com> ptp: ptp_s390: Add missing facility check Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Coia Prant <coiaprant(a)gmail.com> net: pcs: xpcs: fix SGMII state reading Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Manjunath Patil <manjunath.b.patil(a)oracle.com> net/mlx5e: Use sender devcom for MPV master-up Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Markus Breitenberger <bre(a)keba.com> net: stmmac: intel: skip SerDes reconfig when rate is unchanged Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: fix a memory leak due to bootstrapping sheaves twice Shengming Hu <hu.shengming(a)zte.com.cn> mm/slub: fix lost local objects when bulk remote free batch fills Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein <amir73il(a)gmail.com> fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Chen Changcheng <chenchangcheng(a)kylinos.cn> fs/super: fix emergency thaw double-unlock of s_umount Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown Shihuang Liu <shlomojune6(a)gmail.com> amt: fix use-after-free in AMT delayed works Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Wentao Liang <vulab(a)iscas.ac.cn> ceph: fix writeback_count leak in write_folio_nounlock() WenTao Liang <vulab(a)iscas.ac.cn> ceph: fix refcount leak in ceph_readdir() Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann <max.kellermann(a)ionos.com> ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Zhiling Zou <roxy520tt(a)gmail.com> sctp: close UDP tunnel sockets during netns teardown Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Rik van Riel <riel(a)surriel.com> mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established Wei Yang <richard.weiyang(a)gmail.com> mm/page_vma_mapped: fix device-private PMD handling Xie Yuanbin <xieyuanbin1(a)huawei.com> mm/memory-failure: trace: change memory_failure_event to ras subsystem Breno Leitao <leitao(a)debian.org> mm/kmemleak: fix checksum computation for per-cpu objects SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() Thomas Weißschuh <linux(a)weissschuh.net> m68k: avoid -Wunused-but-set-parameter in clear_user_page() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Qu Wenruo <wqu(a)suse.com> btrfs: do not try compression for data reloc inodes David Howells <dhowells(a)redhat.com> afs: Fix afs_edit_dir_remove() to get, not find, block 0 Geliang Tang <geliang(a)kernel.org> selftests: mptcp: userspace_pm: fix undefined variable port Geliang Tang <geliang(a)kernel.org> mptcp: pm: userspace: fix use-after-free in get_local_id Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Kalpan Jani <kalpan.jani(a)mpiricsoftware.com> mptcp: fix stale skb->sk reference on subflow close Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fix BUILD_BUG_ON on legacy ARM config Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Dev Jain <dev.jain(a)arm.com> arm64: make huge_ptep_get handled unaligned addresses Fuad Tabba <fuad.tabba(a)linux.dev> tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Ming Lei <tom.leiming(a)gmail.com> ublk: wait on ublk_dev_ready() instead of ub->completion Jackie Liu <liuyun01(a)kylinos.cn> tracing: Propagate errors from remote event bulk updates Steven Rostedt <rostedt(a)goodmis.org> tracing: perf: Fix stale head for perf syscall tracing Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Fix union collision of module and refcnt for dynamic events deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Usama Arif <usama.arif(a)linux.dev> tracing: Fix context switch counter truncation Steven Rostedt <rostedt(a)goodmis.org> tracing: Delay module ref count for "enable_event" trigger Xu Rao <raoxu(a)uniontech.com> misc: nsm: pin the module while the device is open Runyu Xiao <runyu.xiao(a)seu.edu.cn> misc: nsm: only unlock nsm_dev on post-lock error paths Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Ethan Nelson-Moore <enelsonmoore(a)gmail.com> selftests: ntsync: correct CONFIG_NTSYNC name Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ben Hutchings <benh(a)debian.org> uio_hv_generic: Bind to FCopy device by default Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Adrian Ng Ho Yin <adrian.ho.yin.ng(a)altera.com> firmware: stratix10-svc: handle NO_RESPONSE in async poll Adrian Ng Ho Yin <adrian.ho.yin.ng(a)altera.com> firmware: stratix10-svc: fix teardown order in remove to prevent race Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Rong Bao <rong.bao(a)csmantle.top> LoongArch: Retrieve CPU package ID from PPTT when available Kanglong Wang <wangkanglong(a)loongson.cn> LoongArch: Move jump_label_init() before parse_early_param() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT Haoran Jiang <jianghaoran(a)kylinos.cn> LoongArch: Fix oops during single-step debugging Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix build errors due to wrong instructions for 32BIT George Guo <guodongtai(a)kylinos.cn> LoongArch: Fix address space mismatch in kexec command line lookup Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Alexandre Courbot <acourbot(a)nvidia.com> rust: allow `clippy::unwrap_or_default` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 Alice Ryhl <aliceryhl(a)google.com> rust: device: avoid trailing ; in printing macros FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() to round correctly for negative Delta Alice Ryhl <aliceryhl(a)google.com> rust_binder: only print failure if error has source Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath12k: fix NULL pointer dereference in rhash table destroy Wentao Liang <vulab(a)iscas.ac.cn> wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: restrict NPU/PPE active checks to MMIO devices Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: don't re-enter an instance callback that is still running Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: drain a slave's callback before its master detaches it Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Nikita Maksimov <nickstogramm(a)yandex.ru> ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Guangshuo Li <lgs201920130244(a)gmail.com> media: vivid: fix cleanup bugs in vivid_init() Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Benjamin Gaignard <benjamin.gaignard(a)collabora.com> media: verisilicon: Export only needed pixels formats Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> media: uapi: rkisp: Correct name version enum Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Felix Gu <ustc.gu(a)gmail.com> media: ti: vpe: Fix the error code of devm_request_irq() Felix Gu <ustc.gu(a)gmail.com> media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice() Felix Gu <ustc.gu(a)gmail.com> media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete() Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Dmitry Osipenko <dmitry.osipenko(a)collabora.com> media: synopsys: hdmirx: Fix HPD lane hold time Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Valery Borovsky <vebohr(a)gmail.com> media: stm32-dcmipp: Return queued buffers on start_streaming() failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Jacopo Mondi <jacopo.mondi+renesas(a)ideasonboard.com> media: rzv2h-ivc: Wait for frame end in stop_streaming Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 340 Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID GEN3 Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID GEN2 Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 680 Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix memory leaks in probe and remove David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix error handling in npcm_video_init() Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove David Carlier <devnexen(a)gmail.com> media: mali-c55: Power-off the peripheral in remove() Alper Ak <alperyasinak1(a)gmail.com> media: mali-c55: Fix possible ERR_PTR in enable_streams David Carlier <devnexen(a)gmail.com> media: mali-c55: Disable pm_runtime on probe error David Carlier <devnexen(a)gmail.com> media: mali-c55: Add missing of_reserved_mem_device_release() Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ Marco Nenciarini <mnencia(a)kcore.it> media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Sakari Ailus <sakari.ailus(a)linux.intel.com> media: dw9719: Add back the I²C device id table Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Brandon Brnich <b-brnich(a)ti.com> media: chips-media: wave5: Move src_buf Removal to finish_encode Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Ricardo Ribalda <ribalda(a)chromium.org> media: amlogic-c3: Add validations for ae and awb config Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Maíra Canal <mcanal(a)igalia.com> drm/v3d: Reach the GMP through the hub registers on V3D 7.x Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict Stanislav Kinsburskii <skinsburskii(a)gmail.com> drm/gpusvm: Zero HMM PFNs before scanning ranges Matthew Brost <matthew.brost(a)intel.com> drm/ttm/pool: back up at native page order Matthew Brost <matthew.brost(a)intel.com> drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Matthew Brost <matthew.brost(a)intel.com> drm/pagemap: Clear driver-provided PFNs from migration PFN array Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Shut down BO cache timer before teardown Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Fix flip-done timeouts on mode1 reset Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: always emit the job vm fence Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Print vmid, pasid and more task info in devcoredump Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Fix backlight max_brightness to match exported range Alessandro Rinaldi <ale(a)alerinaldi.it> drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 Andriy Korud <a.korud(a)gmail.com> drm/amd/display: dce100: skip non-DP stream encoders for DP MST Leo Li <sunpeng.li(a)amd.com> drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: set new_stream to NULL after release Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Create a device link between APU display and XHCI devices Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu/userq: fix indefinite fence wait during GPU reset Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Release VFCT ACPI table reference Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: return error on truncated firmware Matthew Brost <matthew.brost(a)intel.com> drm/ttm: Account for NULL and handle pages in ttm_pool_backup Honglei Huang <honghuan(a)amd.com> drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Jason Macnak <natsu(a)google.com> drm/virtio: Don't detach GEM from a non-created context Alex Deucher <alexander.deucher(a)amd.com> drm/gfx10: Program DB_RING_CONTROL Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu14 power limit range calculation Jani Nikula <jani.nikula(a)intel.com> drm/i915/mst: limit DP MST ESI service loop Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gt: Fix NULL deref on sched_engine alloc failure Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue Shahyan Soltani <shahyan.soltani(a)amd.com> drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Jakob Linke <jakob(a)linke.cx> drm/amdgpu/soc24: reset dGPU if suspend got aborted Jani Nikula <jani.nikula(a)intel.com> drm/i915/bios: range check LFP Data Block panel_type2 Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: add the doorbell index input for suspending userq Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Leo Li <sunpeng.li(a)amd.com> Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs" WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Honglei Huang <honghuan(a)amd.com> drm/amd/display: use kvzalloc to allocate struct dc Thomas Zimmermann <tzimmermann(a)suse.de> drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips Leorize <leorize+oss(a)disroot.org> drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x Guangshuo Li <lgs201920130244(a)gmail.com> drm/amdkfd: free MQD managers on DQM init failures Yongqiang Sun <Yongqiang.Sun(a)amd.com> drm/amdkfd: fix 32-bit overflow in CWSR total size calculation David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds on CRIU restore queue type and mqd size David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot David Francis <David.Francis(a)amd.com> drm/amdkfd: Use kvcalloc to allocate arrays Xiaogang Chen <xiaogang.chen(a)amd.com> drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size Yongqiang Sun <Yongqiang.Sun(a)amd.com> drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM Luigi Santivetti <luigi.santivetti(a)imgtec.com> drm/imagination: fix error checking of pvr_vm_context_lookup() Shuvam Pandey <shuvampandey1(a)gmail.com> drm/imagination: Fix user array stride in pvr_set_uobj_array() Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix double call to drm_sched_entity_fini() Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/madvise: Skip invalidation for purgeable state updates Alexander Usyskin <alexander.usyskin(a)intel.com> drm/xe/nvm: fix writable override for CRI Zongyao Bai <zongyao.bai(a)intel.com> drm/xe/pt: Reset current_op in xe_pt_update_ops_init() Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: Hold a dma-buf reference for imported BOs Matthew Brost <matthew.brost(a)intel.com> drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Ashutosh Dixit <ashutosh.dixit(a)intel.com> drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG Matthew Brost <matthew.brost(a)intel.com> drm/xe: Return error on non-migratable faults requiring devmem Matthew Auld <matthew.auld(a)intel.com> drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Imre Deak <imre.deak(a)intel.com> drm/i915/mtl+: Enable PPS before PLL Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Gerhard Schwanzer <geschw(a)pm.me> drm/amdkfd: Use exclusive bounds for SVM split alignment checks Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Return errno code from drm_sysfb_get_visible_size() Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Avoid possible truncation with calculating visible size Junrui Luo <moonafterrain(a)outlook.com> drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Fix context pstate override handling Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Jiqian Chen <Jiqian.Chen(a)amd.com> drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 Ivan Lipski <ivan.lipski(a)amd.com> drm/amd/display: Restore periodic detection for DCN35 Brian Nguyen <brian3.nguyen(a)intel.com> drm/xe: Add compact-PT and addr mask handling for page reclaim Tejas Upadhyay <tejas.upadhyay(a)intel.com> drm/xe/guc: Fix buffer overflow in steered register list allocation Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Avoid truncating maximum stride Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Do not page-align visible size of the framebuffer Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande(a)amd.com> drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Fit paired fragment job in the correct CCCB Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Thomas Zimmermann <tzimmermann(a)suse.de> drm/exynos: fbdev: Remove offset into screen_buffer Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Count paired job fence as dependency in prepare_job() Chen Ni <nichen(a)iscas.ac.cn> drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/tidss: Fix missing drm_bridge_add() call Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay David Carlier <devnexen(a)gmail.com> tracing: Fix use-after-free freeing trigger private data Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Pu Lehui <pulehui(a)huawei.com> LoongArch: BPF: Fix memory leak in bpf_jit_free() Mateusz Guzik <mjguzik(a)gmail.com> pidfs: make pidfs_ino_lock static Eric Dumazet <edumazet(a)google.com> drop_monitor: perform u64_stats updates under IRQ-disabled section Eric Dumazet <edumazet(a)google.com> drop_monitor: fix size calculations for 64-bit attributes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD Vikas Gupta <vikas.gupta(a)broadcom.com> bnge/bng_re: fix ring ID widths Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() Minhong He <heminhong(a)kylinos.cn> mctp: check register_netdevice_notifier() error in mctp_device_init() Clark Wang <xiaoning.wang(a)nxp.com> ptp: netc: explicitly clear TMR_OFF during initialization Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rds: tcp: unregister sysctl before tearing down listen socket Nikola Z. Ivanov <zlatistiv(a)gmail.com> ipv6: Change allocation flags to match rcu_read_lock section requirements Emil Tantilov <emil.s.tantilov(a)intel.com> idpf: fix max_vport related crash on allocation error during init Paul Greenwalt <paul.greenwalt(a)intel.com> ice: prevent tstamp ring allocation for non-PF VSI types Marcin Szycik <marcin.szycik(a)linux.intel.com> ice: fix LAG recipe to profile association Vincent Chen <vincent.chen(a)sifive.com> ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-pf: tc: fix egress ratelimiting Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Gal Pressman <gal(a)nvidia.com> net/mlx5: Fix MCIA register buffer overflow on 32 dword reads Runyu Xiao <runyu.xiao(a)seu.edu.cn> raw: annotate lockless match fields in raw_v4_match() Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Nicholas Dudar <main.kalliope(a)gmail.com> LoongArch: BPF: Zero-extend signed ALU32 div/mod results Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation Kuniyuki Iwashima <kuniyu(a)google.com> mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi(). Yun Zhou <yun.zhou(a)windriver.com> net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM vadik likholetov <vadikas(a)gmail.com> net: stmmac: enable the MAC on link up for all supported speeds Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: xgmac: fix l4 filter port overwrite on register update Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc José Expósito <jose.exposito(a)redhat.com> drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Zhang Yi <yi.zhang(a)huawei.com> iomap: fix incorrect did_zero setting in iomap_zero_iter() Zhang Yi <yi.zhang(a)huawei.com> iomap: correct the range of a partial dirty clear Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() Raag Jadav <raag.jadav(a)intel.com> drm/xe/i2c: Allow per domain unique id Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Luis Lang <luis.la(a)mail.de> net: stmmac: dwmac4: mask interrupts when stopping DMA in suspend Michael Walle <mwalle(a)kernel.org> net: dpaa: fix mode setting Chuyi Zhou <zhouchuyi(a)bytedance.com> smp: Make CSD lock acquisition atomic for debug mode Chuyi Zhou <zhouchuyi(a)bytedance.com> smp: Avoid invalid per-CPU CSD lookup with CSD lock debug Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Amir Goldstein <amir73il(a)gmail.com> ovl: check access to copy_file_range source with src mounter creds Gregor Herburger <gregor.herburger(a)linutronix.de> drm/vc4: hvs/v3d: Fix null dereference in unbind Julian Braha <julianbraha(a)gmail.com> drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A Julian Braha <julianbraha(a)gmail.com> drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER Julian Braha <julianbraha(a)gmail.com> drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T Yichong Chen <chenyichong(a)uniontech.com> ovl: fix trusted xattr escape prefix matching Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Satyanarayana K V P <satyanarayana.k.v.p(a)intel.com> drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7925: fix crash in reset link replay Arnd Bergmann <arnd(a)arndb.de> wifi: mt76: fix airoha_npu dependency tracking Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Guangshuo Li <lgs201920130244(a)gmail.com> wifi: mt76: mt7925: guard link STA in decap offload Eric Dumazet <edumazet(a)google.com> ppp: annotate concurrent dev->stats accesses Frank Sorenson <sorenson(a)redhat.com> cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths Frank Sorenson <sorenson(a)redhat.com> cifs: prevent readdir from changing file size due to stale directory metadata Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Willem de Bruijn <willemb(a)google.com> selftests: drv-net: convert so_txtime to drv-net Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: drv-net: increase timeout Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: ovpn: increase timeout Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: ovpn: add IPV6 and VETH configs Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Rishikesh Jethwani <rjethwani(a)purestorage.com> tls: device: push pending open record on splice EOF Myeonghun Pak <mhun512(a)gmail.com> net: mctp i3c: clean up notifier and buses if driver register fails Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() Rob Herring (Arm) <robh(a)kernel.org> accel: ethosu: Handle U85 internal chaining buffer Rob Herring (Arm) <robh(a)kernel.org> accel: ethosu: Fix element size accounting for cmd stream validation Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: check for workqueue allocation failure Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix auxiliary device add/del races Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: order completion reads after the ownership check Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: yield the CPU while waiting for the adminq to drain Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix use-after-free on workqueue during remove Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix deadlock between reset thread and remove HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: txgbe: fix FDIR filter leak on remove Ilia Gavrilov <Ilia.Gavrilov(a)infotecs.ru> rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: txgbe: fix heap overflow when reading module EEPROM Weiming Shi <bestswngs(a)gmail.com> tipc: serialize udp bearer replicast list updates Antoine Tenart <atenart(a)kernel.org> geneve: ensure the skb is writable before fixing its headers Antoine Tenart <atenart(a)kernel.org> geneve: fix hint header definition wrt endianness Kuniyuki Iwashima <kuniyu(a)google.com> net: Call net_enable_timestamp() before failure in sk_clone(). Kuniyuki Iwashima <kuniyu(a)google.com> soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Richard Cheng <icheng(a)nvidia.com> arm64/mm: Check the requested PFN range during memory removal Steven Price <steven.price(a)arm.com> arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: reject component parameter in legacy firmware update Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: copy aggregation information Enrico Zanda <enrico.zanda(a)arm.com> vhost-net: fix TX stall when vhost owns virtio-net header Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: tear down new links on vif update error path Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() Wayen Yan <win847(a)gmail.com> net: airoha: Fix DMA direction for NPU mailbox buffer Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Wayen Yan <win847(a)gmail.com> net: airoha: Fix potential use-after-free in airoha_ppe_deinit() Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() Zhixing Chen <running910(a)gmail.com> gtp: parse extension headers before reading inner protocol Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains Daniel Borkmann <daniel(a)iogearbox.net> bpf: Reject redirect helpers without a bpf_net_context David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Danielle Ratson <danieller(a)nvidia.com> netlink: specs: rt-link: convert bridge port flag attributes to u8 Ricardo B. Marlière <rbm(a)suse.com> selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range Michael Walle <mwalle(a)kernel.org> net: phy: marvell: fix return code Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: validate Realtek vendor event length Daniel Golle <daniel(a)makrotopia.org> regulator: mt6358: use regmap helper to read fixed LDO calibration Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Marco Baffo <marco(a)mandelbit.com> ovpn: use monotonic clock for peer keepalive timeouts Marco Baffo <marco(a)mandelbit.com> ovpn: fix use after free in unlock_ovpn() longlong yan <yanlonglong(a)kylinos.cn> selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote() Qing Ming <a0yami(a)mailbox.org> ovpn: avoid putting unrelated P2P peer on socket release Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Alexis Czezar Torreno <alexisczezar.torreno(a)analog.com> hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers Alexis Czezar Torreno <alexisczezar.torreno(a)analog.com> hwmon: (pmbus/max34440): add support adpm12250 Uwe Kleine-König (The Capable Hub) <u.kleine-koenig(a)baylibre.com> hwmon: Use named initializers for arrays of i2c_device_data Uwe Kleine-König (The Capable Hub) <u.kleine-koenig(a)baylibre.com> hwmon: Drop unused i2c driver_data Mostafa Saleh <smostafa(a)google.com> drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: validate SAR GEO response payload size Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use complete_all() to signal init_completion Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix potential probe() deadlock Guangshuo Li <lgs201920130244(a)gmail.com> arm_mpam: guard MBWU state before adding it to garbage Fenghua Yu <fenghuay(a)nvidia.com> arm_mpam: Fix MPAMCFG_MBW_PBM register setting Ben Horgan <ben.horgan(a)arm.com> arm_mpam: Fix software reset values of MPAMCFG_PRI Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: hda: cs35l41: validate and free ACPI mute object Tycho Andersen (AMD) <tycho(a)kernel.org> iommu/amd: Fix nested domain leak Tycho Andersen (AMD) <tycho(a)kernel.org> iommu/amd: Fix IRQ unsafe locking in gdom allocation Chen-Yu Tsai <wens(a)kernel.org> ASoC: sun4i-codec: Set quirks.playback_only for H616 codec Pengpeng Hou <pengpeng(a)iscas.ac.cn> ASoC: tas2781: bound firmware description string parsing Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert Leo Martins <loemra.dev(a)gmail.com> btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps Dave Chen <davechen(a)synology.com> btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Yingying Tang <yingying.tang(a)oss.qualcomm.com> wifi: ath12k: Fix low MLO RX throughput on WCN7850 Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Denis Benato <denis.benato(a)linux.dev> platform/x86: asus-wmi: temporarily revert to setting a charge limit Yousef Alhouseen <alhouseenyousef(a)gmail.com> platform/x86/intel/vsec: free ACPI discovery data on early errors Rosen Penev <rosenp(a)gmail.com> platform/x86/intel/vsec: allocate res with intel_vsec_dev Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Manikanta Pubbisetty <manikanta.pubbisetty(a)oss.qualcomm.com> wifi: ath10k: fix skb leak on incomplete msdu during rx pop Wayen Yan <win847(a)gmail.com> watchdog: airoha: Prevent division by zero when clock frequency is zero Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Keep verifier_map_ptr exercising ops pointer access KP Singh <kpsingh(a)kernel.org> selftests/bpf: Adjust verifier_map_ptr for the map's excl field Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Georgi Valkov <gvalkov(a)gmail.com> wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Add dp_skip_rbr flag for NUTMEG Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/display: Fix preferred link rate for NUTMEG Ray Wu <ray.wu(a)amd.com> drm/amd/display: Fix ISM dc_lock deadlock during suspend Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: typec: ucsi: Add duplicate detection to nvidia registration path Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix dev_printk() device Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: core: port: Deattach Type-C connector on component unbind Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: sysfs: add lock to bos_descriptors_read() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Andre Carvalho <asantostc(a)gmail.com> selftests: netconsole: only restore MAC when it changed on resume Ruoyu Wang <ruoyuw560(a)gmail.com> bnxt_en: Handle partially initialized auxiliary devices Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Ivan Vecera <ivecera(a)redhat.com> dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() Eric Dumazet <edumazet(a)google.com> tcp: fix TIME_WAIT socket reference leak on PSP policy failure Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix use-after-free of mm_struct in job scheduler Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Vinod Govindapillai <vinod.govindapillai(a)intel.com> drm/i915/wm: clear the plane ddb_y entries on plane disable Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Qihang <q.h.hack.winter(a)gmail.com> ksmbd: pin conn during async oplock break notification Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/guc: Hold device ref until queue teardown completes Arvind Yadav <arvind.yadav(a)intel.com> drm/xe/guc: Keep scheduler timeline name alive Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/xe: Assign queue name in time for drm_sched_init Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/wopcm: fix WOPCM size for LNL+ Matthew Brost <matthew.brost(a)intel.com> drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Mark Harris <mark.hsj(a)gmail.com> riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() Vasily Gorbik <gor(a)linux.ibm.com> s390/checksum: Fix csum_partial() without vector facility Linmao Li <lilinmao(a)kylinos.cn> drm/panthor: Check debugfs GEM lock initialization Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Rosen Penev <rosenp(a)gmail.com> powerpc/85xx: Add fsl,ifc to common device ids Srikanth Boyapally <srikanth.boyapally(a)amd.com> spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled Oliver Hartkopp <socketcan(a)hartkopp.net> can: raw: add locking for raw flags bitfield Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Rui Qi <qirui.001(a)bytedance.com> riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Bluetooth: mgmt: Translate HCI reason in Device Disconnected event Ruoyu Wang <ruoyuw560(a)gmail.com> Bluetooth: hci_qca: Clear memdump state on invalid dump size Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: extend conn_hash lookup critical sections Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Fix wrong register read in LNL failure diagnostics Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: use platform_get_irq() Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered David Jeffery <djeffery(a)redhat.com> scsi: core: wake eh reliably when using scsi_schedule_eh Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Tejun Heo <tj(a)kernel.org> sched_ext: Record an error on errno-only sub-enable failure Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq Matt Bobrowski <mattbobrowski(a)google.com> bpf: Fix UAF in sock clone early bailouts Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Andrea Righi <arighi(a)nvidia.com> sched_ext: Enable tick for finite slices on nohz_full Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: cs42l43: Correct report for forced microphone jack Gao Xiang <xiang(a)kernel.org> erofs: relax sanity check for tail pclusters due to ztailpacking Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: disable MSI on resume in ACP PCI driver Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop Sebastian Ene <sebastianene(a)google.com> firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Mostafa Saleh <smostafa(a)google.com> firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: use wiphy work for socket owner autodisconnect Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Syed Saba Kareem <Syed.SabaKareem(a)amd.com> ASoC: amd: acp: Fix linker error with SDCA quirks Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: avoid non-S1G AID fallback for S1G assoc Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject empty PMSR peer lists Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: constrain MBSSID TX link ID range Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: derive S1G beacon TSF from S1G fields Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Peddolla Harshavardhan Reddy <peddolla.reddy(a)oss.qualcomm.com> wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: mac80211: defer link RX stats percpu free to RCU Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix fils_discovery double free on alloc failure Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Rong Zhang <i(a)rong.moe> ALSA: usb-audio: Fix imbalance per-channel volume of sticky mixers Arnd Bergmann <arnd(a)arndb.de> wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Chen YanJun <moomichen(a)tencent.com> xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() Cen Zhang <zzzccc427(a)gmail.com> xfrm: clear mode callbacks after failed mode setup Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Xue Lei <Xue.Lei(a)windriver.com> mtd: fix double free and WARN_ON in add_mtd_device() error paths Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Chenguang Zhao <zhaochenguang(a)kylinos.cn> RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/mana_ib: initialize err for empty send WR lists Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent user-triggered null deref on QP create Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Remove redundant legacy_mode checks Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent rereg_mr for non-mem regions Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Antony Antony <antony.antony(a)secunet.com> xfrm: reject optional IPTFS templates in outbound policies Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Yixun Lan <dlan(a)kernel.org> reset: spacemit: k3: fix USB2 ahb reset Tejun Heo <tj(a)kernel.org> sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Boris Burkov <boris(a)bur.io> btrfs: fallback to transaction csum tree on a commit root csum miss Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Seth Forshee <sforshee(a)nvidia.com> firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits Petr Wozniak <petr.wozniak(a)gmail.com> xfrm: fix stale skb->prev after async crypto steals a GSO segment Petr Wozniak <petr.wozniak(a)gmail.com> xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Tejun Heo <tj(a)kernel.org> sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs() Doehyun Baek <doehyunbaek(a)gmail.com> Docs/admin-guide/cgroup-v2: fix memory.stat doc details Akhil R <akhilrajeev(a)nvidia.com> arm64: tegra: Remove fallback compatible for GPCDMA Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Ryosuke Yasuoka <ryasuoka(a)redhat.com> drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Kuba Piecuch <jpiecuch(a)google.com> sched_ext: Skip ops.set_weight() for disabled tasks Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Documentation/admin-guide/cgroup-v2.rst | 4 +- Documentation/hwmon/max34440.rst | 27 +- Documentation/netlink/specs/rt-link.yaml | 40 +- Makefile | 9 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/boot/dts/nvidia/tegra264.dtsi | 2 +- arch/arm64/include/asm/esr.h | 2 +- arch/arm64/mm/hugetlbpage.c | 2 +- arch/arm64/mm/mmu.c | 7 +- arch/loongarch/include/asm/asmmacro.h | 2 +- arch/loongarch/kernel/acpi.c | 27 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/loongarch/kernel/machine_kexec.c | 5 +- arch/loongarch/kernel/rethook_trampoline.S | 18 +- arch/loongarch/kernel/setup.c | 3 +- arch/loongarch/kernel/smp.c | 4 +- arch/loongarch/mm/init.c | 5 +- arch/loongarch/net/bpf_jit.c | 9 +- arch/m68k/include/asm/page_mm.h | 2 + arch/powerpc/kernel/time.c | 43 +++ arch/powerpc/mm/mem.c | 5 +- arch/powerpc/platforms/85xx/common.c | 2 + arch/riscv/Kconfig | 2 +- arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kernel/sys_hwprobe.c | 1 + arch/riscv/kvm/aia.c | 35 +- arch/riscv/kvm/vcpu.c | 68 +++- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/riscv/mm/init.c | 5 +- arch/s390/lib/csum-partial.c | 2 +- arch/s390/mm/init.c | 5 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/mm/init_64.c | 5 +- drivers/accel/amdxdna/amdxdna_ctx.c | 4 + drivers/accel/ethosu/ethosu_gem.c | 54 ++- drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +- drivers/android/binder/thread.rs | 14 +- drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/block/ublk_drv.c | 47 ++- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/cpufreq/cpufreq.c | 3 + drivers/crypto/tegra/tegra-se-main.c | 3 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dpll/dpll_netlink.c | 3 + drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 54 ++- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 19 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 62 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 73 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 35 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 22 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 56 +-- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 69 ++-- drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | 24 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 49 ++- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 2 +- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 + drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | 4 +- drivers/gpu/drm/amd/amdgpu/soc24.c | 28 ++ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 12 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 2 + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 1 + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 25 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 24 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 417 +++++++++++---------- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 81 ++-- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_ism.c | 56 ++- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_ism.h | 1 + .../amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 2 - .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 2 - .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 11 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 + .../drm/amd/display/dc/dce/dce_stream_encoder.c | 15 +- .../drm/amd/display/dc/dce/dce_stream_encoder.h | 3 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 7 +- .../display/dc/link/protocols/link_dp_capability.c | 6 +- .../display/dc/resource/dce100/dce100_resource.c | 7 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/include/mes_v11_api_def.h | 2 + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 26 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 12 + drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 12 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 15 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 45 +++ .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 +- .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 7 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_displayid_internal.h | 2 +- drivers/gpu/drm/drm_gpusvm.c | 22 +- drivers/gpu/drm/drm_pagemap.c | 24 +- drivers/gpu/drm/drm_panel_backlight_quirks.c | 9 + drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 6 +- drivers/gpu/drm/i915/display/intel_bios.c | 36 +- drivers/gpu/drm/i915/display/intel_cdclk.c | 41 +- drivers/gpu/drm/i915/display/intel_ddi.c | 11 +- drivers/gpu/drm/i915/display/intel_dp.c | 8 +- .../gpu/drm/i915/display/intel_dp_aux_backlight.c | 7 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 12 +- drivers/gpu/drm/i915/display/intel_vrr.c | 4 + drivers/gpu/drm/i915/display/skl_watermark.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- .../gpu/drm/i915/gt/intel_execlists_submission.c | 19 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/imagination/pvr_context.c | 22 +- drivers/gpu/drm/imagination/pvr_drv.c | 13 +- drivers/gpu/drm/imagination/pvr_queue.c | 65 ++-- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/imagination/pvr_vm.c | 2 + drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/panel/Kconfig | 3 + drivers/gpu/drm/panthor/panthor_device.c | 5 +- drivers/gpu/drm/panthor/panthor_fw.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 18 +- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/sysfb/drm_sysfb_helper.h | 2 +- drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 13 +- drivers/gpu/drm/sysfb/efidrm.c | 7 +- drivers/gpu/drm/sysfb/vesadrm.c | 6 +- drivers/gpu/drm/tegra/fbdev.c | 8 +- drivers/gpu/drm/tests/drm_gem_shmem_test.c | 16 +- drivers/gpu/drm/tidss/tidss_encoder.c | 2 + drivers/gpu/drm/ttm/ttm_backup.c | 123 ++++-- drivers/gpu/drm/ttm/ttm_pool.c | 123 +++++- drivers/gpu/drm/ttm/ttm_pool_internal.h | 8 + drivers/gpu/drm/v3d/v3d_gem.c | 12 + drivers/gpu/drm/vc4/vc4_bo.c | 12 +- drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 2 +- drivers/gpu/drm/virtio/virtgpu_gem.c | 14 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/drm/xe/display/xe_display_bo.c | 3 +- drivers/gpu/drm/xe/display/xe_fb_pin.c | 3 +- drivers/gpu/drm/xe/regs/xe_gtt_defs.h | 6 +- drivers/gpu/drm/xe/xe_bo.c | 58 ++- drivers/gpu/drm/xe/xe_bo.h | 3 +- drivers/gpu/drm/xe/xe_bo_types.h | 2 + drivers/gpu/drm/xe/xe_device.c | 2 +- drivers/gpu/drm/xe/xe_device_types.h | 2 +- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- drivers/gpu/drm/xe/xe_guc_capture.c | 10 +- drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 5 + drivers/gpu/drm/xe/xe_guc_submit.c | 140 ++++--- drivers/gpu/drm/xe/xe_guc_types.h | 2 - drivers/gpu/drm/xe/xe_i2c.c | 5 +- drivers/gpu/drm/xe/xe_migrate.c | 21 +- drivers/gpu/drm/xe/xe_migrate.h | 4 +- drivers/gpu/drm/xe/xe_module.c | 49 +++ drivers/gpu/drm/xe/xe_module.h | 5 + drivers/gpu/drm/xe/xe_nvm.c | 9 +- drivers/gpu/drm/xe/xe_pci.c | 6 + drivers/gpu/drm/xe/xe_pt.c | 148 +++++--- drivers/gpu/drm/xe/xe_reg_whitelist.c | 10 +- drivers/gpu/drm/xe/xe_sriov_vf_ccs.c | 32 +- drivers/gpu/drm/xe/xe_sriov_vf_ccs.h | 3 +- drivers/gpu/drm/xe/xe_svm.c | 6 +- drivers/gpu/drm/xe/xe_vm.c | 33 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 19 +- drivers/gpu/drm/xe/xe_wopcm.c | 15 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hwmon/ad7414.c | 4 +- drivers/hwmon/ad7418.c | 6 +- drivers/hwmon/adc128d818.c | 2 +- drivers/hwmon/adm1025.c | 4 +- drivers/hwmon/adm1026.c | 2 +- drivers/hwmon/adm1029.c | 2 +- drivers/hwmon/adm1031.c | 4 +- drivers/hwmon/adm1177.c | 4 +- drivers/hwmon/adm9240.c | 6 +- drivers/hwmon/ads7828.c | 4 +- drivers/hwmon/adt7410.c | 8 +- drivers/hwmon/adt7411.c | 2 +- drivers/hwmon/adt7462.c | 2 +- drivers/hwmon/adt7470.c | 2 +- drivers/hwmon/adt7475.c | 8 +- drivers/hwmon/aht10.c | 8 +- drivers/hwmon/amc6821.c | 2 +- drivers/hwmon/asb100.c | 2 +- drivers/hwmon/asc7621.c | 6 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/atxp1.c | 2 +- drivers/hwmon/chipcap2.c | 16 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/dme1737.c | 4 +- drivers/hwmon/ds1621.c | 10 +- drivers/hwmon/ds620.c | 4 +- drivers/hwmon/emc1403.c | 24 +- drivers/hwmon/emc2103.c | 2 +- drivers/hwmon/emc2305.c | 8 +- drivers/hwmon/emc6w201.c | 2 +- drivers/hwmon/f75375s.c | 6 +- drivers/hwmon/fschmd.c | 14 +- drivers/hwmon/ftsteutates.c | 2 +- drivers/hwmon/g760a.c | 2 +- drivers/hwmon/g762.c | 6 +- drivers/hwmon/gigabyte_waterforce.c | 4 +- drivers/hwmon/gl518sm.c | 2 +- drivers/hwmon/gl520sm.c | 2 +- drivers/hwmon/hih6130.c | 2 +- drivers/hwmon/hs3001.c | 4 +- drivers/hwmon/htu31.c | 2 +- drivers/hwmon/ina209.c | 2 +- drivers/hwmon/ina238.c | 12 +- drivers/hwmon/ina2xx.c | 16 +- drivers/hwmon/ina3221.c | 2 +- drivers/hwmon/isl28022.c | 2 +- drivers/hwmon/jc42.c | 2 +- drivers/hwmon/lineage-pem.c | 4 +- drivers/hwmon/lm63.c | 6 +- drivers/hwmon/lm73.c | 2 +- drivers/hwmon/lm75.c | 62 +-- drivers/hwmon/lm77.c | 2 +- drivers/hwmon/lm78.c | 4 +- drivers/hwmon/lm80.c | 4 +- drivers/hwmon/lm83.c | 4 +- drivers/hwmon/lm85.c | 24 +- drivers/hwmon/lm87.c | 4 +- drivers/hwmon/lm90.c | 96 ++--- drivers/hwmon/lm92.c | 6 +- drivers/hwmon/lm93.c | 4 +- drivers/hwmon/lm95234.c | 4 +- drivers/hwmon/lm95241.c | 4 +- drivers/hwmon/lm95245.c | 4 +- drivers/hwmon/ltc2945.c | 2 +- drivers/hwmon/ltc2947-i2c.c | 4 +- drivers/hwmon/ltc2990.c | 4 +- drivers/hwmon/ltc2991.c | 4 +- drivers/hwmon/ltc2992.c | 4 +- drivers/hwmon/ltc4151.c | 2 +- drivers/hwmon/ltc4215.c | 2 +- drivers/hwmon/ltc4222.c | 2 +- drivers/hwmon/ltc4245.c | 2 +- drivers/hwmon/ltc4260.c | 2 +- drivers/hwmon/ltc4261.c | 4 +- drivers/hwmon/max127.c | 2 +- drivers/hwmon/max16065.c | 12 +- drivers/hwmon/max1619.c | 2 +- drivers/hwmon/max1668.c | 6 +- drivers/hwmon/max31730.c | 2 +- drivers/hwmon/max31760.c | 2 +- drivers/hwmon/max31790.c | 2 +- drivers/hwmon/max31827.c | 6 +- drivers/hwmon/max6620.c | 2 +- drivers/hwmon/max6621.c | 2 +- drivers/hwmon/max6639.c | 2 +- drivers/hwmon/max6650.c | 4 +- drivers/hwmon/max6697.c | 20 +- drivers/hwmon/mc34vr500.c | 4 +- drivers/hwmon/mcp3021.c | 4 +- drivers/hwmon/nct6775-i2c.c | 26 +- drivers/hwmon/nct7802.c | 2 +- drivers/hwmon/nct7904.c | 4 +- drivers/hwmon/nzxt-kraken3.c | 6 +- drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwmon/pcf8591.c | 2 +- drivers/hwmon/pmbus/acbel-fsg032.c | 4 +- drivers/hwmon/pmbus/adm1266.c | 2 +- drivers/hwmon/pmbus/adm1275.c | 20 +- drivers/hwmon/pmbus/aps-379.c | 4 +- drivers/hwmon/pmbus/bel-pfe.c | 6 +- drivers/hwmon/pmbus/bpa-rs600.c | 6 +- drivers/hwmon/pmbus/crps.c | 4 +- drivers/hwmon/pmbus/delta-ahe50dc-fan.c | 2 +- drivers/hwmon/pmbus/dps920ab.c | 4 +- drivers/hwmon/pmbus/fsp-3y.c | 4 +- drivers/hwmon/pmbus/hac300s.c | 4 +- drivers/hwmon/pmbus/ibm-cffps.c | 8 +- drivers/hwmon/pmbus/ina233.c | 4 +- drivers/hwmon/pmbus/inspur-ipsps.c | 4 +- drivers/hwmon/pmbus/ir35221.c | 4 +- drivers/hwmon/pmbus/ir36021.c | 4 +- drivers/hwmon/pmbus/ir38064.c | 10 +- drivers/hwmon/pmbus/irps5401.c | 4 +- drivers/hwmon/pmbus/isl68137.c | 92 ++--- drivers/hwmon/pmbus/lm25066.c | 10 +- drivers/hwmon/pmbus/lt3074.c | 4 +- drivers/hwmon/pmbus/lt7182s.c | 4 +- drivers/hwmon/pmbus/ltc2978.c | 60 +-- drivers/hwmon/pmbus/ltc3815.c | 2 +- drivers/hwmon/pmbus/max15301.c | 8 +- drivers/hwmon/pmbus/max16064.c | 4 +- drivers/hwmon/pmbus/max16601.c | 10 +- drivers/hwmon/pmbus/max17616.c | 2 +- drivers/hwmon/pmbus/max20730.c | 10 +- drivers/hwmon/pmbus/max20751.c | 4 +- drivers/hwmon/pmbus/max31785.c | 8 +- drivers/hwmon/pmbus/max34440.c | 143 ++++++- drivers/hwmon/pmbus/max8688.c | 2 +- drivers/hwmon/pmbus/mp2856.c | 6 +- drivers/hwmon/pmbus/mp2888.c | 4 +- drivers/hwmon/pmbus/mp2891.c | 2 +- drivers/hwmon/pmbus/mp2925.c | 6 +- drivers/hwmon/pmbus/mp29502.c | 4 +- drivers/hwmon/pmbus/mp2975.c | 8 +- drivers/hwmon/pmbus/mp2993.c | 2 +- drivers/hwmon/pmbus/mp5920.c | 2 +- drivers/hwmon/pmbus/mp5926.c | 4 +- drivers/hwmon/pmbus/mp5990.c | 4 +- drivers/hwmon/pmbus/mp9941.c | 2 +- drivers/hwmon/pmbus/mp9945.c | 4 +- drivers/hwmon/pmbus/mpq7932.c | 6 +- drivers/hwmon/pmbus/mpq8785.c | 10 +- drivers/hwmon/pmbus/pim4328.c | 18 +- drivers/hwmon/pmbus/pli1209bc.c | 4 +- drivers/hwmon/pmbus/pm6764tr.c | 4 +- drivers/hwmon/pmbus/pmbus.c | 60 +-- drivers/hwmon/pmbus/pxe1610.c | 8 +- drivers/hwmon/pmbus/q54sj108a2.c | 8 +- drivers/hwmon/pmbus/stef48h28.c | 4 +- drivers/hwmon/pmbus/stpddc60.c | 6 +- drivers/hwmon/pmbus/tda38640.c | 4 +- drivers/hwmon/pmbus/tps25990.c | 4 +- drivers/hwmon/pmbus/tps40422.c | 4 +- drivers/hwmon/pmbus/tps53679.c | 18 +- drivers/hwmon/pmbus/tps546d24.c | 4 +- drivers/hwmon/pmbus/ucd9000.c | 16 +- drivers/hwmon/pmbus/ucd9200.c | 18 +- drivers/hwmon/pmbus/xdp710.c | 2 +- drivers/hwmon/pmbus/xdp720.c | 4 +- drivers/hwmon/pmbus/xdpe12284.c | 8 +- drivers/hwmon/pmbus/xdpe152c4.c | 6 +- drivers/hwmon/pmbus/xdpe1a2g7b.c | 6 +- drivers/hwmon/pmbus/zl6100.c | 44 +-- drivers/hwmon/powr1220.c | 4 +- drivers/hwmon/pt5161l.c | 4 +- drivers/hwmon/sbtsi_temp.c | 4 +- drivers/hwmon/sg2042-mcu.c | 2 +- drivers/hwmon/sht21.c | 6 +- drivers/hwmon/sht3x.c | 8 +- drivers/hwmon/sht4x.c | 4 +- drivers/hwmon/shtc1.c | 6 +- drivers/hwmon/smsc47m192.c | 2 +- drivers/hwmon/spd5118.c | 2 +- drivers/hwmon/stts751.c | 2 +- drivers/hwmon/tc654.c | 6 +- drivers/hwmon/tc74.c | 4 +- drivers/hwmon/thmc50.c | 4 +- drivers/hwmon/tmp102.c | 2 +- drivers/hwmon/tmp103.c | 2 +- drivers/hwmon/tmp108.c | 8 +- drivers/hwmon/tmp401.c | 10 +- drivers/hwmon/tmp421.c | 10 +- drivers/hwmon/tmp464.c | 4 +- drivers/hwmon/tmp513.c | 4 +- drivers/hwmon/tsc1641.c | 2 +- drivers/hwmon/w83773g.c | 2 +- drivers/hwmon/w83781d.c | 8 +- drivers/hwmon/w83791d.c | 2 +- drivers/hwmon/w83792d.c | 2 +- drivers/hwmon/w83793.c | 2 +- drivers/hwmon/w83795.c | 4 +- drivers/hwmon/w83l785ts.c | 2 +- drivers/hwmon/w83l786ng.c | 2 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/core/verbs.c | 6 +- drivers/infiniband/hw/bng_re/bng_dev.c | 6 +- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/uk.c | 9 +- drivers/infiniband/hw/irdma/user.h | 1 - drivers/infiniband/hw/irdma/verbs.c | 33 +- drivers/infiniband/hw/mana/wr.c | 2 +- drivers/infiniband/sw/siw/siw_verbs.c | 44 ++- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 22 +- drivers/iommu/amd/nested.c | 34 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/i2c/alvium-csi2.c | 21 +- drivers/media/i2c/dw9719.c | 10 + drivers/media/i2c/imx219.c | 2 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +- drivers/media/pci/saa7134/saa7134-video.c | 25 +- .../media/platform/amlogic/c3/isp/c3-isp-params.c | 4 + .../media/platform/arm/mali-c55/mali-c55-core.c | 21 +- drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 7 + drivers/media/platform/aspeed/aspeed-video.c | 1 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 29 +- drivers/media/platform/marvell/cafe-driver.c | 1 + drivers/media/platform/nuvoton/npcm-video.c | 34 +- .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- drivers/media/platform/qcom/camss/camss-csid-340.c | 18 +- drivers/media/platform/qcom/camss/camss-csid-680.c | 30 +- .../media/platform/qcom/camss/camss-csid-gen2.c | 47 +-- .../media/platform/qcom/camss/camss-csid-gen3.c | 28 +- drivers/media/platform/qcom/iris/iris_probe.c | 6 +- .../platform/renesas/rzg2l-cru/rzg2l-cru-regs.h | 1 + .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 17 +- .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 31 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 6 +- drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- .../media/platform/synopsys/hdmirx/snps_hdmirx.c | 4 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vip.c | 16 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/platform/verisilicon/hantro_v4l2.c | 6 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-core.c | 6 +- drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/media/v4l2-core/v4l2-subdev.c | 4 + drivers/misc/mei/bus.c | 16 +- drivers/misc/nsm.c | 3 +- drivers/mtd/mtd_virt_concat.c | 4 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/net/amt.c | 101 +++-- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/airoha/airoha_npu.c | 4 +- drivers/net/ethernet/airoha/airoha_ppe.c | 1 + drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 22 +- drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/broadcom/bnge/bnge.h | 1 + drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c | 8 +- drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 50 ++- drivers/net/ethernet/broadcom/bnge/bnge_netdev.h | 4 +- drivers/net/ethernet/broadcom/bnge/bnge_rmem.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 39 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 34 ++ drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 -- drivers/net/ethernet/intel/ice/ice.h | 3 + drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 - drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_parser.c | 3 + drivers/net/ethernet/intel/ice/ice_ptp.c | 7 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 14 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 3 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 7 +- .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 29 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/port.c | 4 +- drivers/net/ethernet/microsoft/mana/gdma_main.c | 78 +++- .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/realtek/rtase/rtase.h | 8 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 197 ++++++++++ drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 31 ++ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 24 ++ .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 28 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 96 ++--- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c | 6 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 + drivers/net/geneve.c | 27 +- drivers/net/gtp.c | 17 +- drivers/net/mctp/mctp-i3c.c | 11 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/ovpn/io.c | 4 +- drivers/net/ovpn/peer.c | 16 +- drivers/net/ovpn/tcp.c | 6 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/phy/marvell.c | 2 +- drivers/net/ppp/ppp_generic.c | 100 +++-- drivers/net/ppp/pppoe.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 2 + drivers/net/wireless/ath/ath11k/ahb.c | 1 + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/dp_peer.c | 11 +- drivers/net/wireless/ath/ath12k/dp_peer.h | 1 + drivers/net/wireless/ath/ath12k/dp_rx.c | 7 +- drivers/net/wireless/ath/ath12k/hw.h | 16 + drivers/net/wireless/ath/ath12k/mac.c | 10 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath12k/peer.c | 3 + drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 33 ++ drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h | 6 + drivers/net/wireless/ath/ath12k/wifi7/hw.c | 3 + drivers/net/wireless/ath/ath6kl/txrx.c | 12 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 46 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 14 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 9 +- drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 14 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/Kconfig | 4 +- drivers/net/wireless/mediatek/mt76/Makefile | 6 +- drivers/net/wireless/mediatek/mt76/mt76.h | 6 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 13 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/Kconfig | 2 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/platform/loongarch/loongson-laptop.c | 1 + drivers/platform/x86/asus-wmi.c | 26 +- .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/platform/x86/intel/vsec.c | 31 +- drivers/platform/x86/intel/vsec_tpmi.c | 13 +- drivers/ptp/ptp_netc.c | 1 + drivers/ptp/ptp_s390.c | 6 +- drivers/regulator/mt6358-regulator.c | 2 +- drivers/resctrl/mpam_devices.c | 36 +- drivers/reset/spacemit/reset-spacemit-k3.c | 2 +- drivers/scsi/hosts.c | 2 + drivers/scsi/scsi_error.c | 22 +- drivers/scsi/scsi_priv.h | 1 + drivers/spi/spi-cadence-quadspi.c | 12 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 59 ++- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 100 +++-- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/uio/uio_hv_generic.c | 8 +- drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/core/port.c | 2 + drivers/usb/core/sysfs.c | 8 +- drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/f_tcm.c | 192 ++++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 93 +++-- drivers/usb/gadget/udc/fsl_usb2_udc.h | 1 + drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/musb/omap2430.c | 2 - drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 ++- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/usb/typec/ucsi/ucsi.c | 158 +++++++- drivers/vhost/net.c | 8 +- drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c | 2 +- drivers/watchdog/airoha_wdt.c | 3 + drivers/watchdog/ni903x_wdt.c | 7 +- drivers/watchdog/s32g_wdt.c | 3 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/dir_edit.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/btrfs_inode.h | 2 + fs/btrfs/extent_io.c | 4 +- fs/btrfs/extent_map.c | 4 +- fs/btrfs/file-item.c | 26 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/addr.c | 9 + fs/ceph/caps.c | 1 + fs/ceph/dir.c | 7 +- fs/ceph/ioctl.c | 6 + fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keysetup_v1.c | 8 +- fs/erofs/zmap.c | 3 +- fs/exec.c | 2 +- fs/f2fs/super.c | 25 +- fs/fuse/dev_uring.c | 22 +- fs/iomap/buffered-io.c | 42 ++- fs/nfsd/vfs.c | 6 +- fs/overlayfs/file.c | 16 +- fs/overlayfs/xattrs.c | 2 +- fs/pidfs.c | 2 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 69 +++- fs/smb/client/inode.c | 6 + fs/smb/client/misc.c | 106 +++++- fs/smb/client/smb2file.c | 21 ++ fs/smb/client/smb2inode.c | 23 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/connection.c | 16 +- fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smbacl.c | 42 ++- fs/super.c | 34 +- fs/xfs/scrub/cow_repair.c | 203 ++++++---- fs/xfs/scrub/trace.h | 28 +- include/drm/drm_connector.h | 6 +- include/drm/drm_utils.h | 1 + include/drm/ttm/ttm_backup.h | 12 +- include/linux/arm_ffa.h | 2 +- include/linux/audit.h | 4 +- include/linux/audit_arch.h | 12 +- include/linux/bnge/hsi.h | 7 +- include/linux/bootconfig.h | 3 + include/linux/firmware/intel/stratix10-smc.h | 4 + include/linux/fscrypt.h | 18 +- include/linux/intel_vsec.h | 6 +- include/linux/memory_hotplug.h | 8 +- include/linux/mlx5/mlx5_ifc.h | 13 +- include/linux/seqlock.h | 7 +- include/linux/sunrpc/xdr.h | 19 +- include/linux/vtime.h | 6 + include/media/v4l2-async.h | 4 +- include/media/videobuf2-core.h | 8 +- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/rfcomm.h | 3 + include/net/cfg80211.h | 4 +- include/net/pkt_cls.h | 14 +- include/net/sctp/structs.h | 3 +- include/net/tcp.h | 2 + include/scsi/scsi_host.h | 3 + include/trace/events/memory-failure.h | 6 +- include/uapi/linux/btrfs.h | 2 +- include/uapi/linux/rkisp1-config.h | 6 +- init/Kconfig | 3 + init/main.c | 45 --- io_uring/rw.c | 42 ++- kernel/audit.c | 2 +- kernel/audit.h | 19 +- kernel/audit_fsnotify.c | 32 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 25 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 2 +- kernel/sched/ext.c | 134 ++++--- kernel/sched/ext_internal.h | 30 ++ kernel/smp.c | 30 +- kernel/trace/ftrace.c | 13 + kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 1 + kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_events_hist.c | 2 + kernel/trace/trace_events_trigger.c | 22 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- kernel/trace/trace_remote.c | 16 +- kernel/trace/trace_syscalls.c | 5 + lib/bootconfig.c | 65 ++++ lib/compat_audit.c | 12 +- lib/rhashtable.c | 1 + mm/damon/core.c | 13 + mm/huge_memory.c | 12 +- mm/kmemleak.c | 7 +- mm/memory_hotplug.c | 13 +- mm/memremap.c | 4 +- mm/page_vma_mapped.c | 33 +- mm/slub.c | 21 +- mm/sparse-vmemmap.c | 46 ++- mm/userfaultfd.c | 5 +- net/bluetooth/hci_event.c | 18 +- net/bluetooth/hci_sync.c | 79 +++- net/bluetooth/mgmt.c | 105 +++++- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/can/j1939/transport.c | 18 +- net/can/raw.c | 66 ++-- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/cls_lock_client.c | 8 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 16 +- net/core/bpf_sk_storage.c | 2 - net/core/dev.c | 10 +- net/core/drop_monitor.c | 18 +- net/core/filter.c | 17 +- net/core/gro.c | 4 +- net/core/sock.c | 13 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/datagram.c | 4 +- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/ip_gre.c | 4 +- net/ipv4/nexthop.c | 2 +- net/ipv4/raw.c | 23 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_ipv4.c | 14 +- net/ipv4/tcp_minisocks.c | 12 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_gre.c | 4 +- net/ipv6/raw.c | 2 +- net/ipv6/route.c | 4 +- net/ipv6/tcp_ipv6.c | 8 +- net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/mac80211/cfg.c | 14 +- net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/mlme.c | 6 +- net/mac80211/nan.c | 35 +- net/mac80211/rx.c | 2 + net/mac80211/sta_info.c | 15 +- net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mctp/device.c | 4 +- net/mpls/af_mpls.c | 11 +- net/mptcp/options.c | 17 +- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 34 +- net/openvswitch/actions.c | 19 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/ib.c | 4 + net/rds/ib_cm.c | 4 + net/rds/recv.c | 15 + net/rds/tcp.c | 12 +- net/rxrpc/ar-internal.h | 6 +- net/sched/act_tunnel_key.c | 14 +- net/sched/cls_api.c | 6 +- net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_drr.c | 2 +- net/sched/sch_dualpi2.c | 2 +- net/sched/sch_ets.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_hfsc.c | 2 +- net/sched/sch_htb.c | 2 +- net/sched/sch_multiq.c | 2 +- net/sched/sch_prio.c | 2 +- net/sched/sch_qfq.c | 2 +- net/sched/sch_sfb.c | 2 +- net/sched/sch_sfq.c | 2 +- net/sctp/auth.c | 2 +- net/sctp/protocol.c | 21 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sctp/sysctl.c | 9 +- net/sunrpc/svcsock.c | 14 +- net/sunrpc/xdr.c | 210 ++++++++++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 5 +- net/tipc/udp_media.c | 56 ++- net/tls/tls_device.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 165 +++++++- net/wireless/core.c | 14 +- net/wireless/core.h | 4 +- net/wireless/nl80211.c | 25 +- net/wireless/pmsr.c | 34 +- net/wireless/scan.c | 13 +- net/wireless/sme.c | 6 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_device.c | 12 +- net/xfrm/xfrm_iptfs.c | 1 + net/xfrm/xfrm_policy.c | 4 +- net/xfrm/xfrm_state.c | 11 +- net/xfrm/xfrm_user.c | 3 +- rust/bindings/lib.rs | 4 + rust/kernel/device.rs | 20 +- rust/kernel/time.rs | 11 +- rust/uapi/lib.rs | 4 + sound/core/seq/seq_timer.c | 13 +- sound/core/timer.c | 21 +- sound/hda/codecs/hdmi/hdmi.c | 3 + sound/hda/codecs/hdmi/hdmi_local.h | 9 + sound/hda/codecs/hdmi/intelhdmi.c | 36 +- sound/hda/codecs/realtek/alc269.c | 9 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 11 +- sound/soc/amd/acp/Kconfig | 10 +- sound/soc/amd/acp/Makefile | 3 +- sound/soc/amd/acp/amd-acp70-acpi-match.c | 2 +- sound/soc/amd/acp/soc-acpi-amd-sdca-quirks.c | 4 - sound/soc/amd/ps/pci-ps.c | 33 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 17 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 +++- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/fsl/imx-card.c | 12 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/soc/sunxi/sun4i-codec.c | 1 + sound/usb/mixer.c | 2 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 1 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_map_ptr.c | 36 +- tools/testing/selftests/drivers/net/.gitignore | 1 + tools/testing/selftests/drivers/net/Makefile | 2 + tools/testing/selftests/drivers/net/config | 5 + .../drivers/net/netconsole/netcons_resume.sh | 3 +- tools/testing/selftests/drivers/net/settings | 1 + .../selftests/{ => drivers}/net/so_txtime.c | 35 +- tools/testing/selftests/drivers/net/so_txtime.py | 103 +++++ tools/testing/selftests/drivers/ntsync/config | 2 +- tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/.gitignore | 1 - tools/testing/selftests/net/Makefile | 2 - tools/testing/selftests/net/af_unix/config | 1 + tools/testing/selftests/net/mptcp/userspace_pm.sh | 2 +- tools/testing/selftests/net/openvswitch/config | 16 + tools/testing/selftests/net/ovpn/config | 2 + tools/testing/selftests/net/ovpn/ovpn-cli.c | 4 +- tools/testing/selftests/net/ovpn/settings | 1 + tools/testing/selftests/net/so_txtime.sh | 110 ------ tools/testing/selftests/net/tun.c | 8 +- 946 files changed, 9236 insertions(+), 4123 deletions(-)

1 month, 1 week

[PATCH 6.18 000/675] 6.18.42-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.42 release. There are 675 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:45 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.42-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.42-rc1 Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug Koen Koning <koen.koning(a)linux.intel.com> gpu: Fix uninitialized buddy for built-in drivers Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix dwmac4 transmit performance regression Gal Pressman <gal(a)nvidia.com> net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Alice Ryhl <aliceryhl(a)google.com> rust: device: avoid trailing ; in printing macros Miguel Ojeda <ojeda(a)kernel.org> rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization Adrian Hunter <adrian.hunter(a)intel.com> i3c: mipi-i3c-hci: Fix Hot-Join NACK Guoniu Zhou <guoniu.zhou(a)oss.nxp.com> pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI Marco Felsch <m.felsch(a)pengutronix.de> pmdomain: imx93-blk-ctrl: convert to devm_* only Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Michael Bommarito <michael.bommarito(a)gmail.com> octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify Shradha Gupta <shradhagupta(a)linux.microsoft.com> net: mana: Optimize irq affinity for low vcpu configs Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Tony Luck <tony.luck(a)intel.com> fs/resctrl: Fix use-after-free during unmount Tony Luck <tony.luck(a)intel.com> fs/resctrl: Move RMID initialization to first mount Tony Luck <tony.luck(a)intel.com> fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] Tony Luck <tony.luck(a)intel.com> x86,fs/resctrl: Rename some L3 specific functions Tony Luck <tony.luck(a)intel.com> x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain Tony Luck <tony.luck(a)intel.com> fs/resctrl: Split L3 dependent parts out of __mon_event_count() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Ingo Blechschmidt <iblech(a)speicherleck.de> dm: avoid leaking the caller's thread keyring via the table device file Christian Brauner <brauner(a)kernel.org> cred: add kernel_cred() helper Doruk Tan Ozturk <doruk(a)0sec.ai> accel/amdxdna: reject command submission on devices without a submit op Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma-pcie: Reject devices without driver data Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> dmaengine: dw-edma: Fix confusing cleanup.h syntax Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Pratyush Yadav (Google) <pratyush(a)kernel.org> kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES Muchun Song <muchun.song(a)linux.dev> mm/sparse-vmemmap: fix vmemmap accounting underflow Tanmay Shah <tanmay.shah(a)amd.com> remoteproc: xlnx: Check remote core state Terry Bowman <terry.bowman(a)amd.com> cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size Dave Jiang <dave.jiang(a)intel.com> cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c Terry Bowman <terry.bowman(a)amd.com> cxl/pci: Remove unnecessary CXL RCH handling helper functions Terry Bowman <terry.bowman(a)amd.com> cxl/pci: Remove unnecessary CXL Endpoint handling helper functions Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Jeff Layton <jlayton(a)kernel.org> sunrpc: allocate a separate bvec array for socket sends Mike Snitzer <snitzer(a)kernel.org> NFSD: pass nfsd_file to nfsd_iter_read() Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam(a)amd.com> gpu/buddy: bail out of try_harder when alignment cannot be honoured Joel Fernandes <joelagnelf(a)nvidia.com> gpu: Move DRM buddy allocator one level up (part two) Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Theodor Arsenij Larionov-Trichkine <theodorlarionov(a)gmail.com> netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: remove register tracking infrastructure Abel Vesa <abel.vesa(a)oss.qualcomm.com> arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: correct RBR opp entry Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: return internal vq group struct as map token Darrick J. Wong <djwong(a)kernel.org> xfs: don't replace the wrong part of the cow fork Joanne Koong <joannelkoong(a)gmail.com> fuse-uring: fix race between registration and connection abortion Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 Mickaël Salaün <mic(a)digikod.net> landlock: Account all audit data allocations to user space Mickaël Salaün <mic(a)digikod.net> landlock: Fix formatting Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate ACE size against SID sub-authorities Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Ming Lei <tom.leiming(a)gmail.com> ublk: wait on ublk_dev_ready() instead of ub->completion Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: fix buffer overflow in FEC calculation Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit range calculation Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture mapping leak Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Ce Sun <cesun102(a)amd.com> drm/amdgpu: fix resource leak on ACP reset timeout Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho <luciano.coelho(a)intel.com> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Jakob Linke <jakob(a)linke.cx> drm/amdgpu/soc24: reset dGPU if suspend got aborted Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix amdgpu_pm_info power display units Ethan Nelson-Moore <enelsonmoore(a)gmail.com> watchdog: s32g_wdt: remove incorrect options in watchdog_info struct James Raphael Tiovalen <jamestiotio(a)gmail.com> vxlan: mdb: Fix source list corruption on a failed replace Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: collapse receive queue under memory pressure Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> tcp: initialize standalone TCP-AO response padding Justin Lai <justinlai0215(a)realtek.com> rtase: Workaround for TX hang caused by hardware packet parsing Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Shuvam Pandey <shuvampandey1(a)gmail.com> ovpn: hold peer before scheduling keepalive work Pavitra Jha <jhapavitra98(a)gmail.com> ovpn: fix peer refcount leak in TCP error paths Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov <security(a)auditcode.ai> mac802154: hold an interface reference across the scan worker Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ice: reject out-of-range ptype in ice_parser_profile_init Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Carl Johnson <carl(a)jpartners.org> smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Reset triggers at top level before instance loop Paul Greenwalt <paul.greenwalt(a)intel.com> ice: fix PTP Call Trace during PTP release Sven Schnelle <svens(a)linux.ibm.com> ptp: ptp_s390: Add missing facility check Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Coia Prant <coiaprant(a)gmail.com> net: pcs: xpcs: fix SGMII state reading Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Manjunath Patil <manjunath.b.patil(a)oracle.com> net/mlx5e: Use sender devcom for MPV master-up Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Markus Breitenberger <bre(a)keba.com> net: stmmac: intel: skip SerDes reconfig when rate is unchanged Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein <amir73il(a)gmail.com> fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Chen Changcheng <chenchangcheng(a)kylinos.cn> fs/super: fix emergency thaw double-unlock of s_umount Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown Shihuang Liu <shlomojune6(a)gmail.com> amt: fix use-after-free in AMT delayed works Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len Wentao Liang <vulab(a)iscas.ac.cn> ceph: fix writeback_count leak in write_folio_nounlock() WenTao Liang <vulab(a)iscas.ac.cn> ceph: fix refcount leak in ceph_readdir() Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann <max.kellermann(a)ionos.com> ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Zhiling Zou <roxy520tt(a)gmail.com> sctp: close UDP tunnel sockets during netns teardown Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Rik van Riel <riel(a)surriel.com> mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established Breno Leitao <leitao(a)debian.org> mm/kmemleak: fix checksum computation for per-cpu objects David Howells <dhowells(a)redhat.com> afs: Fix afs_edit_dir_remove() to get, not find, block 0 Geliang Tang <geliang(a)kernel.org> mptcp: pm: userspace: fix use-after-free in get_local_id Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Dev Jain <dev.jain(a)arm.com> arm64: make huge_ptep_get handled unaligned addresses Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing: Fix union collision of module and refcnt for dynamic events deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Usama Arif <usama.arif(a)linux.dev> tracing: Fix context switch counter truncation Xu Rao <raoxu(a)uniontech.com> misc: nsm: pin the module while the device is open Runyu Xiao <runyu.xiao(a)seu.edu.cn> misc: nsm: only unlock nsm_dev on post-lock error paths Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Ethan Nelson-Moore <enelsonmoore(a)gmail.com> selftests: ntsync: correct CONFIG_NTSYNC name Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ben Hutchings <benh(a)debian.org> uio_hv_generic: Bind to FCopy device by default Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rhashtable: clear stale iter->p on table restart Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Rong Bao <rong.bao(a)csmantle.top> LoongArch: Retrieve CPU package ID from PPTT when available Kanglong Wang <wangkanglong(a)loongson.cn> LoongArch: Move jump_label_init() before parse_early_param() Haoran Jiang <jianghaoran(a)kylinos.cn> LoongArch: Fix oops during single-step debugging George Guo <guodongtai(a)kylinos.cn> LoongArch: Fix address space mismatch in kexec command line lookup Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Alexandre Courbot <acourbot(a)nvidia.com> rust: allow `clippy::unwrap_or_default` globally FUJITA Tomonori <fujita.tomonori(a)gmail.com> rust: time: fix as_micros_ceil() to round correctly for negative Delta Alice Ryhl <aliceryhl(a)google.com> rust_binder: only print failure if error has source Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Wentao Liang <vulab(a)iscas.ac.cn> wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init() LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: don't re-enter an instance callback that is still running Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: drain a slave's callback before its master detaches it Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Nikita Maksimov <nickstogramm(a)yandex.ru> ALSA: hda/realtek: Fix speakers on Lunnen Ground 14 Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Guangshuo Li <lgs201920130244(a)gmail.com> media: vivid: fix cleanup bugs in vivid_init() Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Benjamin Gaignard <benjamin.gaignard(a)collabora.com> media: verisilicon: Export only needed pixels formats Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Dmitry Osipenko <dmitry.osipenko(a)collabora.com> media: synopsys: hdmirx: Fix HPD lane hold time Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Valery Borovsky <vebohr(a)gmail.com> media: stm32-dcmipp: Return queued buffers on start_streaming() failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID GEN3 Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID GEN2 Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID 680 Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix memory leaks in probe and remove David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix error handling in npcm_video_init() Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ Marco Nenciarini <mnencia(a)kcore.it> media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Brandon Brnich <b-brnich(a)ti.com> media: chips-media: wave5: Move src_buf Removal to finish_encode Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Ricardo Ribalda <ribalda(a)chromium.org> media: amlogic-c3: Add validations for ae and awb config Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Maíra Canal <mcanal(a)igalia.com> drm/v3d: Reach the GMP through the hub registers on V3D 7.x Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Shut down BO cache timer before teardown Leo Li <sunpeng.li(a)amd.com> drm/amd/display: Fix flip-done timeouts on mode1 reset Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Fix backlight max_brightness to match exported range Alessandro Rinaldi <ale(a)alerinaldi.it> drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 Andriy Korud <a.korud(a)gmail.com> drm/amd/display: dce100: skip non-DP stream encoders for DP MST Leo Li <sunpeng.li(a)amd.com> drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: set new_stream to NULL after release Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Release VFCT ACPI table reference Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: return error on truncated firmware Matthew Brost <matthew.brost(a)intel.com> drm/ttm: Account for NULL and handle pages in ttm_pool_backup Jason Macnak <natsu(a)google.com> drm/virtio: Don't detach GEM from a non-created context Alex Deucher <alexander.deucher(a)amd.com> drm/gfx10: Program DB_RING_CONTROL Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu14 power limit range calculation Jani Nikula <jani.nikula(a)intel.com> drm/i915/mst: limit DP MST ESI service loop Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Shahyan Soltani <shahyan.soltani(a)amd.com> drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled Jani Nikula <jani.nikula(a)intel.com> drm/i915/bios: range check LFP Data Block panel_type2 Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Thomas Zimmermann <tzimmermann(a)suse.de> drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips Yongqiang Sun <Yongqiang.Sun(a)amd.com> drm/amdkfd: fix 32-bit overflow in CWSR total size calculation David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds on CRIU restore queue type and mqd size David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot David Francis <David.Francis(a)amd.com> drm/amdkfd: Use kvcalloc to allocate arrays Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM Luigi Santivetti <luigi.santivetti(a)imgtec.com> drm/imagination: fix error checking of pvr_vm_context_lookup() Shuvam Pandey <shuvampandey1(a)gmail.com> drm/imagination: Fix user array stride in pvr_set_uobj_array() Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix double call to drm_sched_entity_fini() Nitin Gote <nitin.r.gote(a)intel.com> drm/xe: Hold a dma-buf reference for imported BOs Matthew Brost <matthew.brost(a)intel.com> drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds Matthew Brost <matthew.brost(a)intel.com> drm/xe: Return error on non-migratable faults requiring devmem Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Return errno code from drm_sysfb_get_visible_size() Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Avoid possible truncation with calculating visible size Junrui Luo <moonafterrain(a)outlook.com> drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Jiqian Chen <Jiqian.Chen(a)amd.com> drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2 Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Avoid truncating maximum stride Thomas Zimmermann <tzimmermann(a)suse.de> drm/sysfb: Do not page-align visible size of the framebuffer Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu/gfx: fix cleaner shader IB buffer overflow Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Fit paired fragment job in the correct CCCB Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Count paired job fence as dependency in prepare_job() Chen Ni <nichen(a)iscas.ac.cn> drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/tidss: Fix missing drm_bridge_add() call Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() Minhong He <heminhong(a)kylinos.cn> mctp: check register_netdevice_notifier() error in mctp_device_init() Clark Wang <xiaoning.wang(a)nxp.com> ptp: netc: explicitly clear TMR_OFF during initialization Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rds: tcp: unregister sysctl before tearing down listen socket Nikola Z. Ivanov <zlatistiv(a)gmail.com> ipv6: Change allocation flags to match rcu_read_lock section requirements Paul Greenwalt <paul.greenwalt(a)intel.com> ice: prevent tstamp ring allocation for non-PF VSI types Marcin Szycik <marcin.szycik(a)linux.intel.com> ice: fix LAG recipe to profile association Vincent Chen <vincent.chen(a)sifive.com> ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-pf: tc: fix egress ratelimiting Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Gal Pressman <gal(a)nvidia.com> net/mlx5: Fix MCIA register buffer overflow on 32 dword reads Gal Pressman <gal(a)nvidia.com> net/mlx5: Refactor EEPROM query error handling to return status separately Runyu Xiao <runyu.xiao(a)seu.edu.cn> raw: annotate lockless match fields in raw_v4_match() Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation Yun Zhou <yun.zhou(a)windriver.com> net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM vadik likholetov <vadikas(a)gmail.com> net: stmmac: enable the MAC on link up for all supported speeds Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: xgmac: fix l4 filter port overwrite on register update Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: cores: remove many xxx_SHIFT definitions Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: socfpga: Add hardware supported cross-timestamp Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: socfpga: Enable TBS support for Agilex5 Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: socfpga: Agilex5 EMAC platform configuration Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: remove xstats.pcs_* members Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc José Expósito <jose.exposito(a)redhat.com> drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Zhang Yi <yi.zhang(a)huawei.com> iomap: correct the range of a partial dirty clear Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() Raag Jadav <raag.jadav(a)intel.com> drm/xe/i2c: Allow per domain unique id Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Michael Walle <mwalle(a)kernel.org> net: dpaa: fix mode setting Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Amir Goldstein <amir73il(a)gmail.com> ovl: check access to copy_file_range source with src mounter creds Christian Brauner <brauner(a)kernel.org> ovl: port ovl_copyfile() to cred guard Christian Brauner <brauner(a)kernel.org> ovl: add override_creds cleanup guard extension for overlayfs Christian Brauner <brauner(a)kernel.org> cred: add scoped_with_kernel_creds() Julian Braha <julianbraha(a)gmail.com> drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER Yichong Chen <chenyichong(a)uniontech.com> ovl: fix trusted xattr escape prefix matching Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7925: fix crash in reset link replay Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Guangshuo Li <lgs201920130244(a)gmail.com> wifi: mt76: mt7925: guard link STA in decap offload Eric Dumazet <edumazet(a)google.com> ppp: annotate concurrent dev->stats accesses Qingfang Deng <dqfext(a)gmail.com> ppp: don't store tx skb in the fastpath Qingfang Deng <dqfext(a)gmail.com> ppp: enable TX scatter-gather Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: drv-net: increase timeout Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: ovpn: increase timeout Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: ovpn: add IPV6 and VETH configs Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Rishikesh Jethwani <rjethwani(a)purestorage.com> tls: device: push pending open record on splice EOF Myeonghun Pak <mhun512(a)gmail.com> net: mctp i3c: clean up notifier and buses if driver register fails Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: check for workqueue allocation failure Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix auxiliary device add/del races Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: order completion reads after the ownership check Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: yield the CPU while waiting for the adminq to drain Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix use-after-free on workqueue during remove Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix deadlock between reset thread and remove HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: txgbe: fix FDIR filter leak on remove Kuniyuki Iwashima <kuniyu(a)google.com> net: Call net_enable_timestamp() before failure in sk_clone(). Kuniyuki Iwashima <kuniyu(a)google.com> soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Steven Price <steven.price(a)arm.com> arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: reject component parameter in legacy firmware update Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Enrico Zanda <enrico.zanda(a)arm.com> vhost-net: fix TX stall when vhost owns virtio-net header Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: tear down new links on vif update error path Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() Wayen Yan <win847(a)gmail.com> net: airoha: Fix DMA direction for NPU mailbox buffer Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Wayen Yan <win847(a)gmail.com> net: airoha: Fix potential use-after-free in airoha_ppe_deinit() Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() Zhixing Chen <running910(a)gmail.com> gtp: parse extension headers before reading inner protocol Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Danielle Ratson <danieller(a)nvidia.com> netlink: specs: rt-link: convert bridge port flag attributes to u8 Michael Walle <mwalle(a)kernel.org> net: phy: marvell: fix return code Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: validate Realtek vendor event length Daniel Golle <daniel(a)makrotopia.org> regulator: mt6358: use regmap helper to read fixed LDO calibration Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Marco Baffo <marco(a)mandelbit.com> ovpn: use monotonic clock for peer keepalive timeouts Marco Baffo <marco(a)mandelbit.com> ovpn: fix use after free in unlock_ovpn() longlong yan <yanlonglong(a)kylinos.cn> selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote() Qing Ming <a0yami(a)mailbox.org> ovpn: avoid putting unrelated P2P peer on socket release Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Mostafa Saleh <smostafa(a)google.com> drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: validate SAR GEO response payload size Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use complete_all() to signal init_completion Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix potential probe() deadlock Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Don't use devres to unregister component Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: hda: cs35l41: validate and free ACPI mute object Chen-Yu Tsai <wens(a)kernel.org> ASoC: sun4i-codec: Set quirks.playback_only for H616 codec Pengpeng Hou <pengpeng(a)iscas.ac.cn> ASoC: tas2781: bound firmware description string parsing Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert Leo Martins <loemra.dev(a)gmail.com> btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps Dave Chen <davechen(a)synology.com> btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Wayen Yan <win847(a)gmail.com> watchdog: airoha: Prevent division by zero when clock frequency is zero Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Keep verifier_map_ptr exercising ops pointer access KP Singh <kpsingh(a)kernel.org> selftests/bpf: Adjust verifier_map_ptr for the map's excl field Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Georgi Valkov <gvalkov(a)gmail.com> wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: typec: ucsi: Add duplicate detection to nvidia registration path Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix dev_printk() device Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: core: port: Deattach Type-C connector on component unbind Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: sysfs: add lock to bos_descriptors_read() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Ivan Vecera <ivecera(a)redhat.com> dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() Eric Dumazet <edumazet(a)google.com> tcp: fix TIME_WAIT socket reference leak on PSP policy failure Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix use-after-free of mm_struct in job scheduler Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Vinod Govindapillai <vinod.govindapillai(a)intel.com> drm/i915/wm: clear the plane ddb_y entries on plane disable Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Qihang <q.h.hack.winter(a)gmail.com> ksmbd: pin conn during async oplock break notification Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/wopcm: fix WOPCM size for LNL+ Matthew Brost <matthew.brost(a)intel.com> drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves Satyanarayana K V P <satyanarayana.k.v.p(a)intel.com> drm/xe/vf: Shadow buffer management for CCS read/write operations Satyanarayana K V P <satyanarayana.k.v.p(a)intel.com> drm/xe/sa: Shadow buffer support in the sub-allocator pool Michał Winiarski <michal.winiarski(a)intel.com> drm/xe: Allow the caller to pass guc_buf_cache size Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Mark Harris <mark.hsj(a)gmail.com> riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() Vasily Gorbik <gor(a)linux.ibm.com> s390/checksum: Fix csum_partial() without vector facility Linmao Li <lilinmao(a)kylinos.cn> drm/panthor: Check debugfs GEM lock initialization Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Rosen Penev <rosenp(a)gmail.com> powerpc/85xx: Add fsl,ifc to common device ids Oliver Hartkopp <socketcan(a)hartkopp.net> can: raw: add locking for raw flags bitfield Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Ruoyu Wang <ruoyuw560(a)gmail.com> Bluetooth: hci_qca: Clear memdump state on invalid dump size Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: extend conn_hash lookup critical sections Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Fix wrong register read in LNL failure diagnostics Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: use platform_get_irq() Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered David Jeffery <djeffery(a)redhat.com> scsi: core: wake eh reliably when using scsi_schedule_eh Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: cs42l43: Correct report for forced microphone jack Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: disable MSI on resume in ACP PCI driver Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop Sebastian Ene <sebastianene(a)google.com> firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Mostafa Saleh <smostafa(a)google.com> firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: mac80211: avoid non-S1G AID fallback for S1G assoc Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: constrain MBSSID TX link ID range Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: derive S1G beacon TSF from S1G fields Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Peddolla Harshavardhan Reddy <peddolla.reddy(a)oss.qualcomm.com> wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: mac80211: defer link RX stats percpu free to RCU Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix fils_discovery double free on alloc failure Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Chen YanJun <moomichen(a)tencent.com> xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() Cen Zhang <zzzccc427(a)gmail.com> xfrm: clear mode callbacks after failed mode setup Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Xue Lei <Xue.Lei(a)windriver.com> mtd: fix double free and WARN_ON in add_mtd_device() error paths Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/mana_ib: initialize err for empty send WR lists Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent user-triggered null deref on QP create Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Remove redundant legacy_mode checks Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent rereg_mr for non-mem regions Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add pinned revocable dmabuf import interface Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Antony Antony <antony.antony(a)secunet.com> xfrm: reject optional IPTFS templates in outbound policies Tejun Heo <tj(a)kernel.org> sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() John Stultz <jstultz(a)google.com> sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Boris Burkov <boris(a)bur.io> btrfs: fallback to transaction csum tree on a commit root csum miss Filipe Manana <fdmanana(a)suse.com> btrfs: use bool type for btrfs_path members used as booleans Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Seth Forshee <sforshee(a)nvidia.com> firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits Petr Wozniak <petr.wozniak(a)gmail.com> xfrm: fix stale skb->prev after async crypto steals a GSO segment Petr Wozniak <petr.wozniak(a)gmail.com> xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() Eric Dumazet <edumazet(a)google.com> net: plumb drop reasons to __dev_queue_xmit() Eric Dumazet <edumazet(a)google.com> net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Akhil R <akhilrajeev(a)nvidia.com> arm64: tegra: Remove fallback compatible for GPCDMA Junxi Qian <qjx1298677004(a)gmail.com> fuse: fix writeback array overflow when max_pages is one Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Allow KASAN to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Cure some more scoped_seqlock() optimization fails Kiryl Shutsemau <kas(a)kernel.org> fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race Ryosuke Yasuoka <ryasuoka(a)redhat.com> drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Brian Witte <brianwitte(a)mailfence.com> netfilter: nf_tables: revert commit_mutex usage in reset path Brian Witte <brianwitte(a)mailfence.com> netfilter: nft_quota: use atomic64_xchg for reset Brian Witte <brianwitte(a)mailfence.com> netfilter: nft_counter: serialize reset with spinlock Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Documentation/gpu/drm-mm.rst | 10 +- Documentation/netlink/specs/rt-link.yaml | 40 +- MAINTAINERS | 13 + Makefile | 9 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/boot/dts/nvidia/tegra264.dtsi | 2 +- arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 12 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 32 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8250.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 77 +- arch/arm64/include/asm/esr.h | 2 +- arch/arm64/mm/hugetlbpage.c | 2 +- arch/loongarch/kernel/acpi.c | 27 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/loongarch/kernel/machine_kexec.c | 5 +- arch/loongarch/kernel/setup.c | 3 +- arch/loongarch/kernel/smp.c | 4 +- arch/powerpc/kernel/time.c | 43 + arch/powerpc/platforms/85xx/common.c | 2 + arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kernel/sys_hwprobe.c | 1 + arch/riscv/kvm/aia.c | 35 +- arch/riscv/kvm/vcpu.c | 68 +- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/s390/lib/csum-partial.c | 2 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kernel/cpu/resctrl/core.c | 32 +- arch/x86/kernel/cpu/resctrl/internal.h | 18 +- arch/x86/kernel/cpu/resctrl/monitor.c | 36 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- drivers/accel/amdxdna/amdxdna_ctx.c | 8 + drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +- drivers/android/binder/thread.rs | 14 +- drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/block/ublk_drv.c | 52 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/cpufreq/cpufreq.c | 3 + drivers/crypto/tegra/tegra-se-main.c | 3 +- drivers/cxl/Kconfig | 4 + drivers/cxl/core/Makefile | 2 +- drivers/cxl/core/core.h | 31 + drivers/cxl/core/pci.c | 215 +--- drivers/cxl/core/ras.c | 197 ++- drivers/cxl/core/trace.h | 24 +- drivers/cxl/cxl.h | 22 +- drivers/cxl/cxlpci.h | 16 + drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/dw-edma/dw-edma-pcie.c | 7 +- drivers/dma/sh/rz-dmac.c | 96 +- drivers/dpll/dpll_netlink.c | 3 + drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 54 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/firmware/xilinx/zynqmp.c | 1 + drivers/gpu/Kconfig | 13 + drivers/gpu/Makefile | 4 +- drivers/gpu/buddy.c | 1347 ++++++++++++++++++++ drivers/gpu/drm/Kconfig | 5 +- drivers/gpu/drm/Kconfig.debug | 1 - drivers/gpu/drm/Makefile | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 62 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_res_cursor.h | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 79 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.h | 20 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 22 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 49 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/soc24.c | 28 + drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 12 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 2 + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 24 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 374 +++--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 81 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 9 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 +- .../display/dc/resource/dce100/dce100_resource.c | 7 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 26 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 15 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/drm_buddy.c | 1278 +------------------ drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_displayid_internal.h | 2 +- drivers/gpu/drm/drm_gpusvm.c | 4 +- drivers/gpu/drm/drm_panel_backlight_quirks.c | 9 + drivers/gpu/drm/i915/display/intel_bios.c | 36 +- drivers/gpu/drm/i915/display/intel_dp.c | 8 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 12 +- drivers/gpu/drm/i915/display/skl_watermark.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 3 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/i915/i915_scatterlist.c | 10 +- drivers/gpu/drm/i915/i915_ttm_buddy_manager.c | 59 +- drivers/gpu/drm/i915/i915_ttm_buddy_manager.h | 4 +- .../gpu/drm/i915/selftests/intel_memory_region.c | 20 +- drivers/gpu/drm/imagination/pvr_context.c | 22 +- drivers/gpu/drm/imagination/pvr_drv.c | 13 +- drivers/gpu/drm/imagination/pvr_queue.c | 65 +- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/imagination/pvr_vm.c | 2 + drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/panel/Kconfig | 1 + drivers/gpu/drm/panthor/panthor_device.c | 5 +- drivers/gpu/drm/panthor/panthor_fw.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 18 +- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/sysfb/drm_sysfb_helper.h | 2 +- drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 13 +- drivers/gpu/drm/sysfb/efidrm.c | 7 +- drivers/gpu/drm/sysfb/vesadrm.c | 6 +- drivers/gpu/drm/tests/Makefile | 1 - drivers/gpu/drm/tests/drm_exec_test.c | 2 - drivers/gpu/drm/tests/drm_gem_shmem_test.c | 16 +- drivers/gpu/drm/tests/drm_mm_test.c | 2 - drivers/gpu/drm/tidss/tidss_encoder.c | 2 + drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c | 4 +- drivers/gpu/drm/ttm/tests/ttm_mock_manager.c | 18 +- drivers/gpu/drm/ttm/tests/ttm_mock_manager.h | 4 +- drivers/gpu/drm/ttm/ttm_pool.c | 34 +- drivers/gpu/drm/v3d/v3d_gem.c | 12 + drivers/gpu/drm/vc4/vc4_bo.c | 12 +- drivers/gpu/drm/virtio/virtgpu_gem.c | 14 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/drm/xe/xe_bo.c | 58 +- drivers/gpu/drm/xe/xe_bo.h | 3 +- drivers/gpu/drm/xe/xe_bo_types.h | 2 + drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- drivers/gpu/drm/xe/xe_guc_buf.c | 44 +- drivers/gpu/drm/xe/xe_guc_buf.h | 1 + drivers/gpu/drm/xe/xe_i2c.c | 5 +- drivers/gpu/drm/xe/xe_migrate.c | 62 +- drivers/gpu/drm/xe/xe_migrate.h | 4 + drivers/gpu/drm/xe/xe_pt.c | 14 +- drivers/gpu/drm/xe/xe_res_cursor.h | 34 +- drivers/gpu/drm/xe/xe_sa.c | 67 +- drivers/gpu/drm/xe/xe_sa.h | 20 +- drivers/gpu/drm/xe/xe_sa_types.h | 3 + drivers/gpu/drm/xe/xe_sriov_vf_ccs.c | 42 +- drivers/gpu/drm/xe/xe_sriov_vf_ccs.h | 4 +- drivers/gpu/drm/xe/xe_svm.c | 18 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr.c | 71 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr_types.h | 4 +- drivers/gpu/drm/xe/xe_vm.c | 10 +- drivers/gpu/drm/xe/xe_wopcm.c | 15 +- drivers/gpu/host1x/bus.c | 4 +- drivers/gpu/tests/Makefile | 4 + .../drm_buddy_test.c => tests/gpu_buddy_test.c} | 358 +++--- .../{drm/lib/drm_random.c => tests/gpu_random.c} | 18 +- .../{drm/lib/drm_random.h => tests/gpu_random.h} | 18 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/gigabyte_waterforce.c | 4 +- drivers/hwmon/nzxt-kraken3.c | 6 +- drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i3c/master/mipi-i3c-hci/core.c | 16 +- drivers/i3c/master/mipi-i3c-hci/hci.h | 1 + drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 + drivers/infiniband/core/umem_dmabuf.c | 61 + drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/uk.c | 9 +- drivers/infiniband/hw/irdma/user.h | 1 - drivers/infiniband/hw/irdma/verbs.c | 33 +- drivers/infiniband/hw/mana/wr.c | 2 +- drivers/infiniband/sw/siw/siw_verbs.c | 44 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 22 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/md/dm-verity-fec.c | 110 +- drivers/md/dm-verity-fec.h | 6 +- drivers/md/dm.c | 11 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/i2c/alvium-csi2.c | 21 +- drivers/media/i2c/imx219.c | 2 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +- drivers/media/pci/saa7134/saa7134-video.c | 25 +- .../media/platform/amlogic/c3/isp/c3-isp-params.c | 4 + drivers/media/platform/aspeed/aspeed-video.c | 1 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 29 +- drivers/media/platform/marvell/cafe-driver.c | 1 + drivers/media/platform/nuvoton/npcm-video.c | 34 +- .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- drivers/media/platform/qcom/camss/camss-csid-680.c | 30 +- .../media/platform/qcom/camss/camss-csid-gen2.c | 47 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 28 +- drivers/media/platform/qcom/iris/iris_probe.c | 6 +- .../platform/renesas/rzg2l-cru/rzg2l-cru-regs.h | 1 + .../media/platform/renesas/rzg2l-cru/rzg2l-video.c | 17 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 6 +- drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- .../media/platform/synopsys/hdmirx/snps_hdmirx.c | 4 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/platform/verisilicon/hantro_v4l2.c | 6 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-core.c | 6 +- drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/media/v4l2-core/v4l2-subdev.c | 4 + drivers/misc/mei/bus.c | 16 +- drivers/misc/nsm.c | 3 +- drivers/mmc/host/vub300.c | 24 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/net/amt.c | 101 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/airoha/airoha_npu.c | 4 +- drivers/net/ethernet/airoha/airoha_ppe.c | 1 + drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 22 +- drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 34 + drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/ice/ice.h | 3 + drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 - drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_parser.c | 3 + drivers/net/ethernet/intel/ice/ice_ptp.c | 7 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 14 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../net/ethernet/marvell/octeontx2/af/rvu_rep.c | 8 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 29 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/port.c | 39 +- drivers/net/ethernet/microsoft/mana/gdma_main.c | 78 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/realtek/rtase/rtase.h | 8 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 197 +++ drivers/net/ethernet/stmicro/stmmac/common.h | 3 - drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 31 + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 162 ++- drivers/net/ethernet/stmicro/stmmac/dwmac100.h | 9 +- drivers/net/ethernet/stmicro/stmmac/dwmac1000.h | 16 +- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 49 +- .../net/ethernet/stmicro/stmmac/dwmac1000_dma.c | 16 +- .../net/ethernet/stmicro/stmmac/dwmac100_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c | 3 +- drivers/net/ethernet/stmicro/stmmac/dwmac4.h | 49 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 53 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 44 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 16 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h | 10 +- drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c | 10 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 34 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 45 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 75 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 + drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 + drivers/net/geneve.c | 3 + drivers/net/gtp.c | 17 +- drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/mctp/mctp-i3c.c | 11 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/ovpn/io.c | 4 +- drivers/net/ovpn/peer.c | 16 +- drivers/net/ovpn/tcp.c | 6 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/phy/marvell.c | 2 +- drivers/net/ppp/ppp_generic.c | 239 ++-- drivers/net/ppp/pppoe.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/ahb.c | 1 + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath6kl/txrx.c | 12 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 9 +- drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 14 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 13 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 8 +- drivers/platform/loongarch/loongson-laptop.c | 1 + .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/pmdomain/imx/imx93-blk-ctrl.c | 126 +- drivers/ptp/ptp_netc.c | 1 + drivers/ptp/ptp_s390.c | 6 +- drivers/regulator/mt6358-regulator.c | 2 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 50 +- drivers/scsi/hosts.c | 2 + drivers/scsi/scsi_error.c | 22 +- drivers/scsi/scsi_priv.h | 1 + drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 30 + drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 59 +- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 100 +- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/uio/uio_hv_generic.c | 8 +- drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/core/port.c | 2 + drivers/usb/core/sysfs.c | 8 +- drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/f_tcm.c | 192 ++- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 93 +- drivers/usb/gadget/udc/fsl_usb2_udc.h | 1 + drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/musb/omap2430.c | 2 - drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/usb/typec/ucsi/ucsi.c | 158 ++- drivers/vdpa/vdpa_user/iova_domain.c | 29 +- drivers/vdpa/vdpa_user/iova_domain.h | 8 +- drivers/vdpa/vdpa_user/vduse_dev.c | 112 +- drivers/vhost/net.c | 8 +- drivers/video/Kconfig | 1 + drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c | 2 +- drivers/watchdog/airoha_wdt.c | 3 + drivers/watchdog/s32g_wdt.c | 3 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/dir_edit.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/backref.c | 16 +- fs/btrfs/block-group.c | 8 +- fs/btrfs/ctree.c | 28 +- fs/btrfs/ctree.h | 16 +- fs/btrfs/defrag.c | 4 +- fs/btrfs/dev-replace.c | 4 +- fs/btrfs/extent-tree.c | 8 +- fs/btrfs/extent_io.c | 4 +- fs/btrfs/extent_map.c | 4 +- fs/btrfs/file-item.c | 38 +- fs/btrfs/free-space-cache.c | 7 +- fs/btrfs/free-space-tree.c | 4 +- fs/btrfs/inode-item.c | 2 +- fs/btrfs/inode.c | 4 +- fs/btrfs/qgroup.c | 4 +- fs/btrfs/raid-stripe-tree.c | 4 +- fs/btrfs/relocation.c | 10 +- fs/btrfs/scrub.c | 20 +- fs/btrfs/send.c | 14 +- fs/btrfs/tree-log.c | 20 +- fs/btrfs/volumes.c | 6 +- fs/btrfs/xattr.c | 2 +- fs/ceph/addr.c | 9 + fs/ceph/caps.c | 1 + fs/ceph/dir.c | 7 +- fs/ceph/ioctl.c | 6 + fs/crypto/inline_crypt.c | 57 +- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/f2fs/super.c | 25 +- fs/fuse/dev_uring.c | 22 +- fs/fuse/file.c | 5 +- fs/iomap/buffered-io.c | 34 +- fs/nfsd/nfs4xdr.c | 8 +- fs/nfsd/vfs.c | 15 +- fs/nfsd/vfs.h | 2 +- fs/overlayfs/copy_up.c | 12 +- fs/overlayfs/file.c | 47 +- fs/overlayfs/overlayfs.h | 5 + fs/overlayfs/xattrs.c | 2 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/proc/task_mmu.c | 14 +- fs/resctrl/ctrlmondata.c | 6 +- fs/resctrl/internal.h | 22 +- fs/resctrl/monitor.c | 200 +-- fs/resctrl/rdtgroup.c | 75 +- fs/smb/client/misc.c | 34 +- fs/smb/client/smb2file.c | 21 + fs/smb/client/smb2inode.c | 23 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smbacl.c | 42 +- fs/super.c | 34 +- fs/xfs/scrub/cow_repair.c | 203 +-- fs/xfs/scrub/trace.h | 28 +- include/drm/drm_buddy.h | 165 +-- include/drm/drm_connector.h | 6 +- include/drm/drm_utils.h | 1 + include/linux/arm_ffa.h | 2 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/cred.h | 15 + include/linux/firmware/xlnx-zynqmp.h | 13 + include/linux/fscrypt.h | 18 +- include/linux/gpu_buddy.h | 177 +++ include/linux/mlx5/mlx5_ifc.h | 13 +- include/linux/resctrl.h | 28 +- include/linux/seqlock.h | 10 +- include/linux/sunrpc/svcsock.h | 3 + include/linux/sunrpc/xdr.h | 19 +- include/linux/virtio.h | 6 +- include/linux/vtime.h | 6 + include/media/v4l2-async.h | 4 +- include/media/videobuf2-core.h | 8 +- include/net/bluetooth/rfcomm.h | 3 + include/net/cfg80211.h | 2 +- include/net/dropreason-core.h | 3 + include/net/ip6_tunnel.h | 2 +- include/net/netfilter/nf_tables.h | 32 - include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 3 - include/net/sctp/structs.h | 3 +- include/net/tcp.h | 2 + include/rdma/ib_umem.h | 19 + include/scsi/scsi_host.h | 3 + include/uapi/linux/btrfs.h | 2 +- init/Kconfig | 3 + init/main.c | 45 - io_uring/rw.c | 42 +- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 36 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 35 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/verifier.c | 17 + kernel/kexec_handover.c | 32 +- kernel/sched/ext.c | 9 +- kernel/trace/ftrace.c | 13 + kernel/trace/trace.c | 2 +- kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events.c | 4 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- lib/bootconfig.c | 65 + lib/compat_audit.c | 12 +- lib/rhashtable.c | 1 + mm/damon/core.c | 13 + mm/huge_memory.c | 12 +- mm/kmemleak.c | 7 +- mm/sparse.c | 32 +- net/bluetooth/hci_sync.c | 55 +- net/bluetooth/mgmt.c | 86 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/nft_meta_bridge.c | 20 - net/bridge/netfilter/nft_reject_bridge.c | 1 - net/can/bcm.c | 528 ++++++-- net/can/j1939/transport.c | 18 +- net/can/raw.c | 66 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/dev.c | 111 +- net/core/filter.c | 6 +- net/core/gro.c | 4 +- net/core/sock.c | 10 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/datagram.c | 4 +- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/ip_gre.c | 4 +- net/ipv4/ip_tunnel_core.c | 2 +- net/ipv4/netfilter/nft_dup_ipv4.c | 1 - net/ipv4/netfilter/nft_fib_ipv4.c | 2 - net/ipv4/netfilter/nft_reject_ipv4.c | 1 - net/ipv4/nexthop.c | 2 +- net/ipv4/raw.c | 23 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 56 +- net/ipv4/tcp_ipv4.c | 14 +- net/ipv4/tcp_minisocks.c | 12 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_gre.c | 4 +- net/ipv6/netfilter/nft_dup_ipv6.c | 1 - net/ipv6/netfilter/nft_fib_ipv6.c | 2 - net/ipv6/netfilter/nft_reject_ipv6.c | 1 - net/ipv6/raw.c | 2 +- net/ipv6/route.c | 4 +- net/ipv6/tcp_ipv6.c | 8 +- net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/mac80211/cfg.c | 11 +- net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/mlme.c | 6 +- net/mac80211/rx.c | 2 + net/mac80211/sta_info.c | 15 +- net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mctp/device.c | 4 +- net/mpls/af_mpls.c | 3 + net/mptcp/options.c | 12 +- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 1 + net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_tables_api.c | 315 +---- net/netfilter/nft_bitwise.c | 104 -- net/netfilter/nft_byteorder.c | 11 - net/netfilter/nft_cmp.c | 3 - net/netfilter/nft_compat.c | 10 - net/netfilter/nft_connlimit.c | 1 - net/netfilter/nft_counter.c | 21 +- net/netfilter/nft_ct.c | 46 - net/netfilter/nft_dup_netdev.c | 1 - net/netfilter/nft_dynset.c | 1 - net/netfilter/nft_exthdr.c | 34 - net/netfilter/nft_fib.c | 51 +- net/netfilter/nft_fib_inet.c | 1 - net/netfilter/nft_fib_netdev.c | 30 +- net/netfilter/nft_flow_offload.c | 1 - net/netfilter/nft_fwd_netdev.c | 2 - net/netfilter/nft_hash.c | 36 - net/netfilter/nft_immediate.c | 12 - net/netfilter/nft_last.c | 1 - net/netfilter/nft_limit.c | 2 - net/netfilter/nft_log.c | 1 - net/netfilter/nft_lookup.c | 12 - net/netfilter/nft_masq.c | 3 - net/netfilter/nft_meta.c | 45 - net/netfilter/nft_nat.c | 2 - net/netfilter/nft_numgen.c | 22 - net/netfilter/nft_objref.c | 2 - net/netfilter/nft_osf.c | 25 - net/netfilter/nft_payload.c | 47 - net/netfilter/nft_queue.c | 2 - net/netfilter/nft_quota.c | 14 +- net/netfilter/nft_range.c | 1 - net/netfilter/nft_redir.c | 3 - net/netfilter/nft_reject_inet.c | 1 - net/netfilter/nft_reject_netdev.c | 1 - net/netfilter/nft_rt.c | 1 - net/netfilter/nft_socket.c | 26 - net/netfilter/nft_synproxy.c | 1 - net/netfilter/nft_tproxy.c | 1 - net/netfilter/nft_tunnel.c | 26 - net/netfilter/nft_xfrm.c | 27 - net/openvswitch/actions.c | 19 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/recv.c | 15 + net/rds/tcp.c | 4 +- net/rxrpc/ar-internal.h | 6 +- net/sched/act_tunnel_key.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/protocol.c | 21 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sctp/sysctl.c | 9 +- net/sunrpc/svcsock.c | 69 +- net/sunrpc/xdr.c | 210 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 1 + net/tls/tls_device.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 165 ++- net/wireless/core.c | 4 +- net/wireless/core.h | 2 +- net/wireless/nl80211.c | 22 +- net/wireless/pmsr.c | 29 +- net/wireless/scan.c | 13 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_device.c | 12 +- net/xfrm/xfrm_iptfs.c | 1 + net/xfrm/xfrm_policy.c | 4 +- net/xfrm/xfrm_state.c | 7 +- net/xfrm/xfrm_user.c | 3 +- rust/bindings/lib.rs | 4 + rust/kernel/device.rs | 16 +- rust/kernel/time.rs | 11 +- rust/uapi/lib.rs | 4 + security/landlock/domain.c | 8 +- security/landlock/domain.h | 5 +- security/landlock/ruleset.c | 7 +- sound/core/seq/seq_timer.c | 13 +- sound/core/timer.c | 21 +- sound/hda/codecs/hdmi/hdmi.c | 3 + sound/hda/codecs/hdmi/hdmi_local.h | 9 + sound/hda/codecs/hdmi/intelhdmi.c | 36 +- sound/hda/codecs/realtek/alc269.c | 9 + sound/hda/codecs/side-codecs/cs35l41_hda.c | 11 +- sound/soc/amd/ps/pci-ps.c | 33 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 25 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/fsl/imx-card.c | 12 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/soc/sunxi/sun4i-codec.c | 1 + sound/usb/quirks.c | 2 + tools/objtool/check.c | 1 + tools/testing/cxl/Kbuild | 2 +- tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 +++ .../testing/selftests/bpf/progs/verifier_map_ptr.c | 36 +- tools/testing/selftests/drivers/net/settings | 1 + tools/testing/selftests/drivers/ntsync/config | 2 +- tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/af_unix/config | 1 + tools/testing/selftests/net/openvswitch/config | 16 + tools/testing/selftests/net/ovpn/config | 2 + tools/testing/selftests/net/ovpn/ovpn-cli.c | 4 +- tools/testing/selftests/net/ovpn/settings | 1 + 776 files changed, 10812 insertions(+), 6601 deletions(-)

1 month, 1 week

[PATCH 6.12 000/602] 6.12.101-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.101 release. There are 602 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 01 Aug 2026 14:13:43 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.101-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.101-rc1 Nikunj A Dadhania <nikunj(a)amd.com> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug David Howells <dhowells(a)redhat.com> afs: Fix uninit var in afs_alloc_anon_key() Pavitra Jha <jhapavitra98(a)gmail.com> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK Nan Li <tonanli66(a)gmail.com> afs: handle CB.InitCallBackState3 requests without a server record David Howells <dhowells(a)redhat.com> afs: Fix delayed allocation of a cell's anonymous key Ivan Vecera <ivecera(a)redhat.com> dpll: fix clock quality level reporting Edward Adam Davis <eadavis(a)qq.com> afs: Set vllist to NULL if addr parsing fails Lukas Bulwahn <lukas.bulwahn(a)redhat.com> net: ethernet: Remove accidental duplication in Kconfig file Nicolas Escande <nico.escande(a)gmail.com> wifi: nl80211: fix nl80211_start_radar_detection return value David Howells <dhowells(a)redhat.com> rxrpc: Fix locking issues with the peer record hash David Howells <dhowells(a)redhat.com> rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link Koen Koning <koen.koning(a)linux.intel.com> gpu: Fix uninitialized buddy for built-in drivers Gal Pressman <gal(a)nvidia.com> net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Johan Hovold <johan(a)kernel.org> usb: musb: omap2430: clean up probe error handling Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix dev_printk() device Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> USB: gadget: Use str_enable_disable-like helpers David Howells <dhowells(a)redhat.com> afs: Fix lack of locking around modifications of net->cells_dyn_ino David Howells <dhowells(a)redhat.com> afs: Fix dynamic lookup to fail on cell lookup failure David Howells <dhowells(a)redhat.com> afs: Simplify cell record handling David Howells <dhowells(a)redhat.com> afs: Fix afs_server ref accounting David Howells <dhowells(a)redhat.com> afs: Use the per-peer app data provided by rxrpc David Howells <dhowells(a)redhat.com> rxrpc: Allow the app to store private data on peer structs David Howells <dhowells(a)redhat.com> afs: Drop the net parameter from afs_unuse_cell() David Howells <dhowells(a)redhat.com> afs: Make afs_lookup_cell() take a trace note David Howells <dhowells(a)redhat.com> afs: Improve server refcount/active count tracing Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately Yang Li <yang.li(a)amlogic.com> Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Théo Lebrun <theo.lebrun(a)bootlin.com> net: macb: drop in-flight Tx SKBs on close Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Dawei Feng <dawei.feng(a)seu.edu.cn> net/mlx5: HWS, fix matcher leak on resize target setup failure Yevgeny Kliteynik <kliteyn(a)nvidia.com> net/mlx5: HWS, Rearrange to prevent forward declaration Wentao Liang <vulab(a)iscas.ac.cn> ipmi: fix refcount leak in i_ipmi_request() Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Sergio Paracuellos <sergio.paracuellos(a)gmail.com> gpio: mt7621: avoid corruption of shared interrupt trigger state Ankit Garg <nktgrg(a)google.com> gve: fix header buffer corruption with header-split and HW-GRO Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Ingo Blechschmidt <iblech(a)speicherleck.de> dm: avoid leaking the caller's thread keyring via the table device file Christian Brauner <brauner(a)kernel.org> cred: add scoped_with_kernel_creds() Christian Brauner <brauner(a)kernel.org> cred: add kernel_cred() helper Christian Brauner <brauner(a)kernel.org> cleanup: fix scoped_class() Christian Brauner <brauner(a)kernel.org> cleanup: add a scoped version of CLASS() Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: fix leaking uninitialized kernel memory Connor Williamson <connordw(a)amazon.com> block: remove redundant GD_NEED_PART_SCAN in add_disk_final() Ming Lei <ming.lei(a)redhat.com> block: add helper add_disk_final() Tristan Madani <tristan(a)talencesecurity.com> bpf: Reset register bounds before narrowing retval range in check_mem_access() Amery Hung <ameryhung(a)gmail.com> bpf: Refactor check_ctx_access() Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Refactor {acquire,release}_reference_state Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Michael Bommarito <michael.bommarito(a)gmail.com> nvmet-auth: reject short AUTH_RECEIVE buffers Damien Le Moal <dlemoal(a)kernel.org> nvmet: Introduce nvmet_req_transfer_len() Dmitry Safonov <0x7f454c46(a)gmail.com> tcp: Decrement tcp_md5_needed static branch Michael Bommarito <michael.bommarito(a)gmail.com> tcp: defer md5sig_info kfree past RCU grace period in tcp_connect Qianyu Luo <qianyuluo3(a)gmail.com> xfrm: nat_keepalive: avoid double free on send error Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> xfrm: Use nested-BH locking for nat_keepalive_sk_ipv[46] Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Koichiro Den <den(a)valinux.co.jp> dmaengine: dw-edma-pcie: Reject devices without driver data Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> dmaengine: dw-edma: Fix confusing cleanup.h syntax Abinash Singh <abinashlalotra(a)gmail.com> dma: dw-edma: Fix build warning in dw_edma_pcie_probe() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Muchun Song <muchun.song(a)linux.dev> mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization David Hildenbrand (Arm) <david(a)kernel.org> mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Muchun Song <muchun.song(a)linux.dev> mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages Bryam Vargas <hexlabsecurity(a)proton.me> landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path Mickaël Salaün <mic(a)digikod.net> landlock: Prepare to use credential instead of domain for fowner Muchun Song <muchun.song(a)linux.dev> mm/sparse-vmemmap: fix vmemmap accounting underflow Deepanshu Kartikey <kartikey406(a)gmail.com> mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch Tanmay Shah <tanmay.shah(a)amd.com> remoteproc: xlnx: Check remote core state Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Return an error from xdr_buf_to_bvec() on overflow Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists Jeff Layton <jlayton(a)kernel.org> sunrpc: allocate a separate bvec array for socket sends Mike Snitzer <snitzer(a)kernel.org> NFSD: pass nfsd_file to nfsd_iter_read() Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam(a)amd.com> gpu/buddy: bail out of try_harder when alignment cannot be honoured Joel Fernandes <joelagnelf(a)nvidia.com> gpu: Move DRM buddy allocator one level up (part two) Theodor Arsenij Larionov-Trichkine <theodorlarionov(a)gmail.com> netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: remove register tracking infrastructure Yue Haibing <yuehaibing(a)huawei.com> netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: rename some boolean operation functions Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Chen-Yu Tsai <wenst(a)chromium.org> ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks Chen-Yu Tsai <wenst(a)chromium.org> ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses Chen-Yu Tsai <wenst(a)chromium.org> ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable Abel Vesa <abel.vesa(a)oss.qualcomm.com> arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: correct RBR opp entry Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Use irq-disabling spinlocks between app and I/O thread David Howells <dhowells(a)redhat.com> rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack David Howells <dhowells(a)redhat.com> rxrpc: Fix CPU time starvation in I/O thread Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Darrick J. Wong <djwong(a)kernel.org> xfs: don't replace the wrong part of the cow fork Long Li <leo.lilong(a)huawei.com> xfs: factor out xfs_attr3_leaf_init Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown David Howells <dhowells(a)redhat.com> rxrpc: Pull out certain app callback funcs into an ops table Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Mingyu Wang <25181214217(a)stu.xidian.edu.cn> i2c: i801: fix hardware state machine corruption in error path Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Break the loop on failure in iommufd_fault_fops_read() Nicolin Chen <nicolinc(a)nvidia.com> iommufd: Reject invalid read count in iommufd_fault_fops_read() SJ Park <sj(a)kernel.org> mm/damon/core: disallow overlapping input ranges for damon_set_regions() SJ Park <sj(a)kernel.org> mm/damon/core: validate ranges in damon_set_regions() Miguel Ojeda <ojeda(a)kernel.org> rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 Eddie Phillips <eddiephillips(a)google.com> gve: fix Rx queue stall on alloc failure Coia Prant <coiaprant(a)gmail.com> net: pcs: xpcs: fix SGMII state reading Yitang Yang <yi1tang.yang(a)gmail.com> io_uring/rw: fix missing ERESTARTSYS conversion in read paths Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources Eric Biggers <ebiggers(a)kernel.org> fscrypt: Avoid dynamic allocation in fscrypt_get_devices() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate ACE size against SID sub-authorities Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: bound DACL dedup walk to copied ACEs Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> net: qrtr: ns: Raise node count limit to 512 Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu13 power limit range calculation Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture mapping leak Ce Sun <cesun102(a)amd.com> drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu: fix division by zero with invalid uvd dimensions Luca Coelho <luciano.coelho(a)intel.com> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vcn4: avoid rereading IB param length Boyuan Zhang <boyuan.zhang(a)amd.com> drm/amdgpu/vce: fix integer overflow in image size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx8: drop unecessary BUG_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: make pp_features read-only when scpm is enabled Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix amdgpu_pm_info power display units James Raphael Tiovalen <jamestiotio(a)gmail.com> vxlan: mdb: Fix source list corruption on a failed replace Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: collapse receive queue under memory pressure Daehyeon Ko <4ncienth(a)gmail.com> tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> tcp: initialize standalone TCP-AO response padding Justin Lai <justinlai0215(a)realtek.com> rtase: Workaround for TX hang caused by hardware packet parsing Asim Viladi Oglu Manizada <manizada(a)pm.me> pppoe: reload header pointer after dev_hard_header() Kyle Zeng <kylebot(a)openai.com> openvswitch: fix GSO userspace truncation underflow Doruk Tan Ozturk <doruk(a)0sec.ai> mctp: serial: handle zero-length frames to prevent rx buffer overflow Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: reject frames shorter than the authentication tag Ibrahim Hashimov <security(a)auditcode.ai> mac802154: hold an interface reference across the scan worker Michael Bommarito <michael.bommarito(a)gmail.com> ila: reload IPv6 header after pskb_may_pull in checksum adjust Sergey Temerkhanov <sergey.temerkhanov(a)intel.com> ice: use READ_ONCE() to access cached PHC time Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ice: reject out-of-range ptype in ice_parser_profile_init James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> rbd: Reset positive result codes to zero in object map update path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Reset triggers at top level before instance loop Paul Greenwalt <paul.greenwalt(a)intel.com> ice: fix PTP Call Trace during PTP release Jann Horn <jannh(a)google.com> proc: Fix broken error paths for namespace links Fan Wu <fanwu01(a)zju.edu.cn> net: hip04: fix RX buffer leak on build_skb failure Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs David Lee <david.lee(a)trailofbits.com> net/x25: fix use-after-free in x25_kill_by_neigh() Manjunath Patil <manjunath.b.patil(a)oracle.com> net/mlx5e: Use sender devcom for MPV master-up Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: fix use-after-free of a severed iucv_path Hidayath Khan <hidayath(a)linux.ibm.com> net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() Doruk Tan Ozturk <doruk(a)0sec.ai> geneve: require CAP_NET_ADMIN in the device netns for changelink Sungmin Kang <726ksm(a)gmail.com> net: slip: serialize receive against buffer reallocation Doruk Tan Ozturk <doruk(a)0sec.ai> vxlan: require CAP_NET_ADMIN in the device netns for changelink Breno Leitao <leitao(a)debian.org> phonet: pep: fix use-after-free in pep_get_sb() Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Disallow SVA if page walk is not coherent Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Eric Biggers <ebiggers(a)kernel.org> fscrypt: Add missing superblock check in find_or_insert_direct_key() Amir Goldstein <amir73il(a)gmail.com> fs: preserve ACL_DONT_CACHE state in forget_cached_acl() Christian Brauner <brauner(a)kernel.org> binfmt_elf_fdpic: only honour the first PT_INTERP Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Shihuang Liu <shlomojune6(a)gmail.com> amt: fix use-after-free in AMT delayed works Douya Le <ldy3087146292(a)gmail.com> libceph: remove debugfs files before client teardown Douya Le <ldy3087146292(a)gmail.com> libceph: reject zero bucket types in crush_decode Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Reject monmaps advertising zero monitors Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> libceph: refresh auth->authorizer_buf{,_len} after authorizer update Zhao Zhang <zzhan461(a)ucr.edu> libceph: guard missing CRUSH type name lookup Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix multiplication overflow in decode_new_up_state_weight() Douya Le <ldy3087146292(a)gmail.com> libceph: bound get_version reply decode to front len WenTao Liang <vulab(a)iscas.ac.cn> ceph: fix refcount leak in ceph_readdir() Bryam Vargas <hexlabsecurity(a)proton.me> ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() Max Kellermann <max.kellermann(a)ionos.com> ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* Zhiling Zou <roxy520tt(a)gmail.com> sctp: close UDP tunnel sockets during netns teardown Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Jun Yang <junvyyang(a)tencent.com> sctp: don't free the ASCONF's own transport in DEL-IP processing Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Will Deacon <will(a)kernel.org> Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" Will Deacon <will(a)kernel.org> arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() deepakraog <gaikwad.dcg(a)gmail.com> tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt <rostedt(a)goodmis.org> tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Xu Rao <raoxu(a)uniontech.com> misc: nsm: pin the module while the device is open Runyu Xiao <runyu.xiao(a)seu.edu.cn> misc: nsm: only unlock nsm_dev on post-lock error paths Guangshuo Li <lgs201920130244(a)gmail.com> intel_th: fix MSC output device reference leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Ben Hutchings <benh(a)debian.org> uio_hv_generic: Bind to FCopy device by default Ian Abbott <abbotti(a)mev.co.uk> comedi: comedi_parport: deal with premature interrupt Nathan Chancellor <nathan(a)kernel.org> x86/boot/compressed: Disable jump tables Tze Yee Ng <tze.yee.ng(a)altera.com> firmware: stratix10-svc: fix memory leaks and list corruption bugs Xu Rao <raoxu(a)uniontech.com> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL Rong Bao <rong.bao(a)csmantle.top> LoongArch: Retrieve CPU package ID from PPTT when available Kanglong Wang <wangkanglong(a)loongson.cn> LoongArch: Move jump_label_init() before parse_early_param() Haoran Jiang <jianghaoran(a)kylinos.cn> LoongArch: Fix oops during single-step debugging Miguel Ojeda <ojeda(a)kernel.org> objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 Alexandre Courbot <acourbot(a)nvidia.com> rust: allow `clippy::unwrap_or_default` globally Zixing Liu <liushuyu(a)aosc.io> platform/loongarch: laptop: Explicitly reset bl_powered state when suspend Christian Brauner <brauner(a)kernel.org> binfmt_misc: set have_execfd only once the interpreter is opened Christian Brauner <brauner(a)kernel.org> exec: fix unsigned loop counter wrap in transfer_args_to_stack() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: Fix session UAF in set_termios Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Protect UUID list traversal MinJea Kim <qndkdrnl(a)gmail.com> staging: rtl8723bs: fix inverted HT40 secondary channel offset Moksh Panicker <mokshpanicker.7(a)gmail.com> staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: make release_scratchbuffers idempotent Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses Huihui Huang <hhhuang(a)smu.edu.sg> wifi: wilc1000: validate assoc response length before subtracting header Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB access from firmware ADDBA window size Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: don't re-enter an instance callback that is still running Norbert Szetei <norbert(a)doyensec.com> ALSA: timer: drain a slave's callback before its master detaches it Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Johan Hovold <johan(a)kernel.org> media: vpif_capture: fix OF node reference imbalance Guangshuo Li <lgs201920130244(a)gmail.com> media: vivid: fix cleanup bugs in vivid_init() Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: check for vb2_is_busy() when toggling caps Hans Verkuil <hverkuil+cisco(a)kernel.org> media: vivid: add vivid_update_reduced_fps() Guangshuo Li <lgs201920130244(a)gmail.com> media: vimc: fix reference leak on failed device registration Guangshuo Li <lgs201920130244(a)gmail.com> media: vidtv: fix reference leak on failed device registration Zile Xiong <xiongzile99(a)gmail.com> media: vb2: use ssize_t for vb2_read/vb2_write Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: v4l2-ctrls: validate HEVC active reference counts Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() Myeonghun Pak <mhun512(a)gmail.com> media: ti: vpe: unwind v4l2 device registration on probe error Hungyu Lin <dennylin0707(a)gmail.com> media: tegra-video: vi: fix invalid u32 return value in format lookup Valery Borovsky <vebohr(a)gmail.com> media: sun4i-csi: Return queued buffers on start_streaming() failure Myeonghun Pak <mhun512(a)gmail.com> media: stm32: dcmi: unregister notifier on probe failure Ma Ke <make24(a)iscas.ac.cn> media: saa7134: Fix a possible memory leak in saa7134_video_init1 Valery Borovsky <vebohr(a)gmail.com> media: rtl2832_sdr: Return queued buffers on start_streaming() failure Deepanshu Kartikey <kartikey406(a)gmail.com> media: rtl2832: fix use-after-free in rtl2832_remove() Myeonghun Pak <mhun512(a)gmail.com> media: radio-si476x: Unregister v4l2_device on probe failure Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: qcom: camss: Fix RDI streaming for CSID GEN2 Valery Borovsky <vebohr(a)gmail.com> media: pwc: Return queued buffers on start_streaming() failure Valery Borovsky <vebohr(a)gmail.com> media: pwc: Drain fill_buf on start_streaming() failure Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> media: pci: dm1105: Free allocated workqueue Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Fix potential out-of-bounds issues Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure Xiaolei Wang <xiaolei.wang(a)windriver.com> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix memory leaks in probe and remove David Carlier <devnexen(a)gmail.com> media: nuvoton: npcm-video: fix error handling in npcm_video_init() Valery Borovsky <vebohr(a)gmail.com> media: msi2500: Return queued buffers on start_streaming() failure Anand Moon <linux.amoon(a)gmail.com> media: meson: vdec: Fix memory leak in error path of vdec_open Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Marco Nenciarini <mnencia(a)kcore.it> media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges Martin Hecht <mhecht73(a)gmail.com> media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Wang Jun <1742789905(a)qq.com> media: cx23885: add ioremap return check and cleanup Johan Hovold <johan(a)kernel.org> media: cx231xx: fix devres lifetime Brandon Brnich <b-brnich(a)ti.com> media: chips-media: wave5: Move src_buf Removal to finish_encode Pengpeng Hou <pengpeng(a)iscas.ac.cn> media: cedrus: skip invalid H.264 reference list entries Samuel Holland <samuel(a)sholland.org> media: cedrus: Fix missing cleanup in error path Myeonghun Pak <mhun512(a)gmail.com> media: cedrus: clean up media device on probe failure Myeonghun Pak <mhun512(a)gmail.com> media: cec: seco: unregister adapter on IR probe failure David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Valery Borovsky <vebohr(a)gmail.com> media: airspy: Return queued buffers on start_streaming() failure Linmao Li <lilinmao(a)kylinos.cn> drm/vc4: Prevent shader BO mappings from becoming writable Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Validate vmw_surface_metadata::array_size Zhu Lingshan <lingshan.zhu(a)amd.com> drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge Andriy Korud <a.korud(a)gmail.com> drm/amd/display: dce100: skip non-DP stream encoders for DP MST WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: set new_stream to NULL after release Timur Kristóf <timur.kristof(a)gmail.com> drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: Fix VFCT bus number matching with soft filter Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: return error on truncated firmware Alex Deucher <alexander.deucher(a)amd.com> drm/gfx10: Program DB_RING_CONTROL Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix smu14 power limit range calculation Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Do not leak siblings[] on proto context error Shahyan Soltani <shahyan.soltani(a)amd.com> drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() Jani Nikula <jani.nikula(a)intel.com> drm/i915/bios: range check LFP Data Block panel_type2 Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915: Return NULL on error in active_instance Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer WenTao Liang <vulab(a)iscas.ac.cn> drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference Thomas Zimmermann <tzimmermann(a)suse.de> drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips Yongqiang Sun <Yongqiang.Sun(a)amd.com> drm/amdkfd: fix 32-bit overflow in CWSR total size calculation David Francis <David.Francis(a)amd.com> drm/amdkfd: Check bounds in allocate_event_notification_slot David Francis <David.Francis(a)amd.com> drm/amdkfd: Use kvcalloc to allocate arrays Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM Luigi Santivetti <luigi.santivetti(a)imgtec.com> drm/imagination: fix error checking of pvr_vm_context_lookup() Shuvam Pandey <shuvampandey1(a)gmail.com> drm/imagination: Fix user array stride in pvr_set_uobj_array() Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix double call to drm_sched_entity_fini() Matthew Brost <matthew.brost(a)intel.com> drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds Pavel Ondračka <pavel.ondracka(a)gmail.com> drm/radeon: fix r100_copy_blit for large BOs Wentao Liang <vulab(a)iscas.ac.cn> drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> drm/i915/gem: Add missing nospec on parallel submit slot Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Junrui Luo <moonafterrain(a)outlook.com> drm/nouveau: fix reversed error cleanup order in ucopy functions Mario Limonciello <mario.limonciello(a)amd.com> drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Fit paired fragment job in the correct CCCB Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Alessio Belle <alessio.belle(a)imgtec.com> drm/imagination: Count paired job fence as dependency in prepare_job() Sergey Shtylyov <s.shtylyov(a)auroraos.dev> drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() Biju Das <biju.das.jz(a)bp.renesas.com> drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() Cen Zhang (Microsoft) <blbllhy(a)gmail.com> rds: tcp: unregister sysctl before tearing down listen socket Marcin Szycik <marcin.szycik(a)linux.intel.com> ice: fix LAG recipe to profile association Vincent Chen <vincent.chen(a)sifive.com> ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV Li RongQing <lirongqing(a)baidu.com> net: ipv6: fix dif and sdif mismatch in raw6_icmp_error Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-pf: tc: fix egress ratelimiting Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Report zero bandwidth for non-ETS traffic classes Yael Chemla <ychemla(a)nvidia.com> net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule Gal Pressman <gal(a)nvidia.com> net/mlx5: Fix MCIA register buffer overflow on 32 dword reads Gal Pressman <gal(a)nvidia.com> net/mlx5: Refactor EEPROM query error handling to return status separately Gal Pressman <gal(a)nvidia.com> net/mlx5: Remove newline at the end of a netlink error message Jiri Pirko <jiri(a)resnulli.us> net/mlx5: DPLL, Add clock quality level op implementation Jiri Pirko <jiri(a)resnulli.us> dpll: add clock quality level attribute and op Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net: qrtr: restrict socket creation to the initial network namespace Chenguang Zhao <zhaochenguang(a)kylinos.cn> hinic: remove unused ethtool RSS user configuration buffers Eric Dumazet <edumazet(a)google.com> ppp: annotate data races in ppp_generic Qingfang Deng <dqfext(a)gmail.com> ppp: enable TX scatter-gather Qingfang Deng <dqfext(a)gmail.com> ppp: convert to percpu netstats Qingfang Deng <dqfext(a)gmail.com> ppp: use IFF_NO_QUEUE in virtual interfaces Eric Dumazet <edumazet(a)google.com> ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup Suman Ghosh <sumang(a)marvell.com> octeontx2-vf: set TC flower flag on MCAM entry allocation Yun Zhou <yun.zhou(a)windriver.com> net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM vadik likholetov <vadikas(a)gmail.com> net: stmmac: enable the MAC on link up for all supported speeds Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: reset residual action in L3L4 filters on delete Nazim Amirul <muhammad.nazim.amirul.nazle.asmade(a)altera.com> net: stmmac: fix l3l4 filter rejecting unsupported offload requests José Expósito <jose.exposito(a)redhat.com> drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem Cen Zhang (Microsoft) <blbllhy(a)gmail.com> tipc: fix u16 MTU truncation in media and bearer MTU validation Zhang Yi <yi.zhang(a)huawei.com> iomap: correct the range of a partial dirty clear Harshaka Narayana <harshaka.narayana(a)broadcom.com> vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets Qing Luo <luoqing(a)kylinos.cn> sctp: auth: verify auth requirement when auth_chunk is NULL Michael Walle <mwalle(a)kernel.org> net: dpaa: fix mode setting Eric Dumazet <edumazet(a)google.com> net: hsr: fix memory leak on slave unregistration by removing synced VLANs Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: vlan: fix vlan range dumps starting with pvid Michael Bommarito <michael.bommarito(a)gmail.com> amt: make the head writable before rewriting the L2 header Michael Bommarito <michael.bommarito(a)gmail.com> amt: re-read skb header pointers after every pull Yichong Chen <chenyichong(a)uniontech.com> ovl: fix trusted xattr escape prefix matching Shelley Yang <shelley.yang(a)infineon.com> wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7925: fix crash in reset link replay Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() Ruoyu Wang <ruoyuw560(a)gmail.com> wifi: mt76: mt7915: guard HE capability lookups Guangshuo Li <lgs201920130244(a)gmail.com> wifi: mt76: mt7925: guard link STA in decap offload Helen Koike <koike(a)igalia.com> tipc: fix infinite loop in __tipc_nl_compat_dumpit Xiang Mei (Microsoft) <xmei5(a)asu.edu> nexthop: initialize extack in nh_res_bucket_migrate() Xiang Mei (Microsoft) <xmei5(a)asu.edu> gtp: check skb_pull_data() return in gtp1u_send_echo_resp() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: openvswitch: add config file Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: af_unix: add USER_NS config Rishikesh Jethwani <rjethwani(a)purestorage.com> tls: device: push pending open record on splice EOF Myeonghun Pak <mhun512(a)gmail.com> net: mctp i3c: clean up notifier and buses if driver register fails Cen Zhang (Microsoft) <blbllhy(a)gmail.com> sctp: validate stream count in sctp_process_strreset_inreq() Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: check for workqueue allocation failure Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix auxiliary device add/del races Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: order completion reads after the ownership check Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: yield the CPU while waiting for the adminq to drain Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix use-after-free on workqueue during remove Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: fix deadlock between reset thread and remove HanQuan <eilaimemedsnaimel(a)gmail.com> sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid Chenguang Zhao <zhaochenguang(a)kylinos.cn> net: txgbe: fix FDIR filter leak on remove Prashanth Kumar KR <PrashanthKumar.K.R(a)amd.com> amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: reject component parameter in legacy firmware update Andrew Pope <andrew.pope(a)morsemicro.com> wifi: mac80211: recalculate TIM when a station enters power save Li RongQing <lirongqing(a)baidu.com> iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() Pengpeng Hou <pengpeng(a)iscas.ac.cn> iommu/amd: Bound the early ACPI HID map HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: mwifiex: bound uAP association event IEs to the event buffer Ruoyu Wang <ruoyuw560(a)gmail.com> wan: wanxl: Only reset hardware after BAR mapping Ruoyu Wang <ruoyuw560(a)gmail.com> nfp: Check resource mutex allocation Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: tear down new links on vif update error path Guanghui Feng <guanghuifeng(a)linux.alibaba.com> iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-eth: put MAC endpoint device on disconnect Guangshuo Li <lgs201920130244(a)gmail.com> dpaa2-switch: put MAC endpoint device on disconnect Zhixing Chen <running910(a)gmail.com> gtp: parse extension headers before reading inner protocol Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> rds: drop incoming messages that cross network namespace boundaries Zhaolong Zhang <zhangzl68(a)chinatelecom.cn> bonding: fix devconf_all NULL dereference when IPv6 is disabled David Lee <david.lee(a)trailofbits.com> net/packet: avoid fanout hook re-registration after unregister Danielle Ratson <danieller(a)nvidia.com> netlink: specs: rt-link: convert bridge port flag attributes to u8 Pengpeng Hou <pengpeng(a)iscas.ac.cn> Bluetooth: btusb: validate Realtek vendor event length Daniel Golle <daniel(a)makrotopia.org> regulator: mt6358: use regmap helper to read fixed LDO calibration Pengpeng Hou <pengpeng(a)iscas.ac.cn> hwmon: occ: validate poll response sensor blocks Yichong Chen <chenyichong(a)uniontech.com> smb: client: validate DFS referral PathConsumed Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) add missed handle for ENOMEM Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix EC read intervals Eugene Shalygin <eugene.shalygin(a)gmail.com> hwmon: (asus-ec-sensors) fix looping over banks while reading from EC Mostafa Saleh <smostafa(a)google.com> drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() Diego Fernando Mancera Gomez <diegomancera.dev(a)gmail.com> usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect Shahar Tzarfati <shahar.tzarfati(a)intel.com> wifi: iwlwifi: mvm: fix read in wake packet notification handler Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: mvm: validate SAR GEO response payload size Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use complete_all() to signal init_completion Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix potential probe() deadlock Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Don't use devres to unregister component Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: hda: cs35l41: validate and free ACPI mute object Denis Arefev <arefev(a)swemel.ru> ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Pengpeng Hou <pengpeng(a)iscas.ac.cn> ASoC: tas2781: bound firmware description string parsing Guanghui Yang <3497809730(a)qq.com> btrfs: free mapping node on duplicate reloc root insert Leo Martins <loemra.dev(a)gmail.com> btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps You-Kai Zheng <ykzheng(a)synology.com> btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix buffer overflow in rx_stream failover path Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: fix OOB read from off-by-two in TX status handler Tristan Madani <tristan(a)talencesecurity.com> wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware IE lengths in connect event Tristan Madani <tristan(a)talencesecurity.com> wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler Ruoyu Wang <ruoyuw560(a)gmail.com> firewire: net: Fix fragmented datagram reassembly Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET Dmitry Morgun <d.morgun(a)ispras.ru> wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() Tzung-Bi Shih <tzungbi(a)kernel.org> watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Guenter Roeck <linux(a)roeck-us.net> hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Edward Adam Davis <eadavis(a)qq.com> hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop Gaole Zhang <gaole.zhang(a)oss.qualcomm.com> wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin Cheng Yongkang <teel4res(a)gmail.com> wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request Xincheng Zhang <zhangxincheng(a)ultrarisc.com> usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits Xie Bo <xb(a)ultrarisc.com> RISC-V: KVM: Serialize virtual interrupt pending state updates Sasha Levin <sashal(a)kernel.org> Revert "drm/amd/display: Add missing kdoc for ALLM parameters" Doruk Tan Ozturk <doruk(a)0sec.ai> crypto: rsa-pkcs1pad: Don't WARN on an empty digest Chukun Pan <amadeus(a)jmu.edu.cn> USB: serial: option: add TDTECH MT5710-CN Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Sunho Park <shpark061104(a)gmail.com> USB: serial: io_edgeport: cap received transmit credits Tim Pambor <timpambor(a)gmail.com> USB: serial: ftdi_sio: add support for E+H FXA291 Muhammad Bilal <meatuni001(a)gmail.com> usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() Johan Hovold <johan(a)kernel.org> USB: gadget: fsl-udc: fix device name leak on probe failure Johan Hovold <johan(a)kernel.org> USB: gadget: snps-udc: fix device name leak on probe failure Melbin K Mathew <mlbnkm1(a)gmail.com> usb: gadget: printer: fix infinite loop in printer_read() Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: f_midi: cancel pending IN work before freeing the midi object Jinchao Wang <wangjinchao600(a)gmail.com> usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: fix usage_count leak when autosuspend_delay is negative Huang Wei <huangwei(a)kylinos.cn> USB: storage: add NO_ATA_1X quirk for Longmai USB Key Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> usb: core: port: Deattach Type-C connector on component unbind Huihui Huang <hhhuang(a)smu.edu.sg> wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: sysfs: add lock to bos_descriptors_read() Weiming Shi <bestswngs(a)gmail.com> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n Xin Long <lucien.xin(a)gmail.com> sctp: fix auth_hmacs array size in struct sctp_cookie Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_tunnel_key: Defer dst_release to RCU callback Emre Cecanpunar <emreleno(a)gmail.com> drm/i915/selftests: Fix GT PM sort comparators Xiang Mei (Microsoft) <xmei5(a)asu.edu> ksmbd: validate compound request size before reading StructureSize2 Qihang <q.h.hack.winter(a)gmail.com> ksmbd: pin conn during async oplock break notification ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move some duplicate definitions to common/cifsglob.h Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/wopcm: fix WOPCM size for LNL+ Shuhao Fu <sfual(a)cse.ust.hk> can: j1939: fix lockless local-destination check Mark Harris <mark.hsj(a)gmail.com> riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() Vasily Gorbik <gor(a)linux.ibm.com> s390/checksum: Fix csum_partial() without vector facility Michal Luczaj <mhal(a)rbox.co> bpf, sockmap: Reject unhashed UDP sockets on sockmap update Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/vtime: Initialize starttime at boot for native accounting Frederic Weisbecker <frederic(a)kernel.org> powerpc/time: Prepare to stop elapsing in dynticks-idle Rosen Penev <rosenp(a)gmail.com> powerpc/85xx: Add fsl,ifc to common device ids Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/i915/gt: use correct selftest config symbol Huiwen He <hehuiwen(a)kylinos.cn> smb/client: handle overlapping allocated ranges in fallocate Ruoyu Wang <ruoyuw560(a)gmail.com> Bluetooth: hci_qca: Clear memdump state on invalid dump size Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update Xiang Mei <xmei5(a)asu.edu> Bluetooth: qca: fix NVM tag length underflow in TLV parser Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Fix wrong register read in LNL failure diagnostics Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: use platform_get_irq() Rosen Penev <rosenp(a)gmail.com> ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered David Jeffery <djeffery(a)redhat.com> scsi: core: wake eh reliably when using scsi_schedule_eh Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Bryam Vargas <hexlabsecurity(a)proton.me> net/iucv: take a reference on the socket found in afiucv_hs_rcv() Weiming Shi <bestswngs(a)gmail.com> ipv4: fib: free fib_alias with kfree_rcu() on insert error path Norbert Szetei <norbert(a)doyensec.com> ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq Pushpendra Singh <pushpendra.singh(a)oss.qualcomm.com> firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context Uday Khare <udaykhare77(a)gmail.com> ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: cs42l43: Correct report for forced microphone jack Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() Christian Hewitt <christianshewitt(a)gmail.com> ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop HE WEI (ギカク) <skyexpoc(a)gmail.com> wifi: cfg80211: bound element ID read when checking non-inheritance Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: brcmfmac: initialize SDIO data work before cleanup Cen Zhang <zzzccc427(a)gmail.com> wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: reject unsupported PMSR FTM location requests Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR FTM preamble range Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: validate PMSR measurement type data Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: validate nested MBSSID IE blobs Zhao Li <enderaoelyther(a)gmail.com> wifi: cfg80211: derive S1G beacon TSF from S1G fields Zhao Li <enderaoelyther(a)gmail.com> wifi: nl80211: free RNR data on MBSSID mismatch Peddolla Harshavardhan Reddy <peddolla.reddy(a)oss.qualcomm.com> wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: define and use wiphy guard Felix Fietkau <nbd(a)nbd.name> wifi: cfg80211: pass net_device to .set_monitor_channel Xiang Mei <xmei5(a)asu.edu> wifi: p54: validate RX frame length in p54_rx_eeprom_readback() Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: libertas: fix memory leak in helper_firmware_cb() Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix fils_discovery double free on alloc failure Xiang Mei <xmei5(a)asu.edu> wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure Bryam Vargas <hexlabsecurity(a)proton.me> wifi: mac80211_hwsim: clamp virtio RX length before skb_put Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() Cen Zhang <zzzccc427(a)gmail.com> wifi: cfg80211: cancel sched scan results work on unregister Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() Aleksandrova Alyona <aga(a)itb.spb.ru> RDMA/irdma: Prevent overflows in memory contiguity checks Malaya Kumar Rout <malayarout91(a)gmail.com> selftests/alsa: Fix memory leak in find_controls error path Xue Lei <Xue.Lei(a)windriver.com> mtd: fix double free and WARN_ON in add_mtd_device() error paths Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/siw: publish QP after initialization Danila Chernetsov <listdansp(a)mail.ru> RDMA/hns: Fix potential integer overflow in mhop hem cleanup Ruoyu Wang <ruoyuw560(a)gmail.com> RDMA/erdma: initialize ret for empty receive WR lists Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Prevent rereg_mr for non-mem regions Jacob Moroni <jmoroni(a)google.com> RDMA/umem: Add pinned revocable dmabuf import interface Or Gerlitz <ogerlitz(a)ddn.com> RDMA/cma: Fix hardware address comparison length in netevent callback Unnathi Chalicheemala <unnathi.chalicheemala(a)oss.qualcomm.com> firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Filipe Manana <fdmanana(a)suse.com> btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Xiang Mei <xmei5(a)asu.edu> btrfs: reject free space cache with more entries than pages Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: nand: mtk-ecc: stop on ECC idle timeouts Pengpeng Hou <pengpeng(a)iscas.ac.cn> mtd: mtdswap: remove debugfs stats file on teardown Michael Bommarito <michael.bommarito(a)gmail.com> IB/mad: Drop unmatched RMPP responses before reassembly Seth Forshee <sforshee(a)nvidia.com> firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits Sumit Gupta <sumitg(a)nvidia.com> arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Harshal Dev <harshal.dev(a)oss.qualcomm.com> soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix logic error in packet reset Seungjin Bae <eeodqql09(a)gmail.com> Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Chuck Lever <chuck.lever(a)oracle.com> xprtrdma: Clear receive-side ownership pointers on release Mikko Perttunen <mperttunen(a)nvidia.com> crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Sasha Levin <sashal(a)kernel.org> Revert "arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc" Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: serialize TX state transitions under so->rx_lock Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: track a single source interface for ANYDEV timeout/throttle ops Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix stale rx/tx ops after device removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add missing device refcount for CAN filter removal Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: validate frame length in bcm_rx_setup() for RTR replies Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: extend bcm_tx_lock usage for data and timer updates Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: fix CAN frame rx/tx statistics Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: add locking when updating filter and timer values Phil Rosenthal <phil(a)phil.gs> KVM: x86/mmu: Fix use-after-free on vendor module reload Hyunwoo Kim <imv4bel(a)gmail.com> KVM: nVMX: Hide shadow VMCS right after VMCLEAR Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Heiko Carstens <hca(a)linux.ibm.com> seqlock: Allow UBSAN_ALIGNMENT to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Allow KASAN to fail optimizing Peter Zijlstra <peterz(a)infradead.org> seqlock: Cure some more scoped_seqlock() optimization fails Kiryl Shutsemau <kas(a)kernel.org> fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race Ryosuke Yasuoka <ryasuoka(a)redhat.com> drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Brian Witte <brianwitte(a)mailfence.com> netfilter: nf_tables: revert commit_mutex usage in reset path Brian Witte <brianwitte(a)mailfence.com> netfilter: nft_quota: use atomic64_xchg for reset Brian Witte <brianwitte(a)mailfence.com> netfilter: nft_counter: serialize reset with spinlock Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix ld_{abs,ind} failure path analysis in subprogs Wayen Yan <win847(a)gmail.com> net: airoha: Fix skb->priority underflow in airoha_dev_select_queue() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Move airoha_eth driver in a dedicated folder Guixiong Wei <weiguixiong(a)bytedance.com> platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug ------------- Diffstat: Documentation/gpu/drm-mm.rst | 10 +- Documentation/netlink/specs/dpll.yaml | 41 + Documentation/netlink/specs/rt_link.yaml | 40 +- Makefile | 9 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 +- arch/arm64/boot/dts/qcom/sc8180x.dtsi | 12 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 32 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8250.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 4 +- arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 77 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 - arch/arm64/mm/mmu.c | 5 +- arch/loongarch/kernel/acpi.c | 27 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/loongarch/kernel/setup.c | 3 +- arch/loongarch/kernel/smp.c | 4 +- arch/loongarch/mm/init.c | 5 +- arch/powerpc/kernel/time.c | 43 + arch/powerpc/mm/mem.c | 5 +- arch/powerpc/platforms/85xx/common.c | 2 + arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kernel/sys_hwprobe.c | 1 + arch/riscv/kvm/aia.c | 34 +- arch/riscv/kvm/vcpu.c | 69 +- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/riscv/mm/init.c | 5 +- arch/s390/lib/csum-partial.c | 2 +- arch/s390/mm/init.c | 5 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/mm/init_64.c | 5 +- block/genhd.c | 42 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +- drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/cpufreq/cpufreq.c | 3 + drivers/crypto/tegra/tegra-se-main.c | 3 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/dw-edma/dw-edma-pcie.c | 63 +- drivers/dma/sh/rz-dmac.c | 96 +- drivers/dpll/dpll_netlink.c | 24 + drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 29 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/firmware/stratix10-svc.c | 10 +- drivers/firmware/xilinx/zynqmp.c | 1 + drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpu/Kconfig | 13 + drivers/gpu/Makefile | 4 +- drivers/gpu/buddy.c | 1347 ++++++++++++++++++++ drivers/gpu/drm/Kconfig | 6 +- drivers/gpu/drm/Makefile | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_res_cursor.h | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 77 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.h | 18 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 22 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 12 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 9 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 +- .../display/dc/resource/dce100/dce100_resource.c | 7 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 26 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 15 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/drm_buddy.c | 1279 +------------------ drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_displayid_internal.h | 2 +- drivers/gpu/drm/i915/display/intel_bios.c | 36 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/i915/i915_scatterlist.c | 10 +- drivers/gpu/drm/i915/i915_ttm_buddy_manager.c | 55 +- drivers/gpu/drm/i915/i915_ttm_buddy_manager.h | 4 +- .../gpu/drm/i915/selftests/intel_memory_region.c | 20 +- drivers/gpu/drm/imagination/pvr_context.c | 22 +- drivers/gpu/drm/imagination/pvr_drv.c | 13 +- drivers/gpu/drm/imagination/pvr_queue.c | 65 +- drivers/gpu/drm/imagination/pvr_queue.h | 2 +- drivers/gpu/drm/imagination/pvr_vm.c | 2 + drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/panthor/panthor_fw.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 2 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/tests/Makefile | 1 - drivers/gpu/drm/tests/drm_exec_test.c | 2 - drivers/gpu/drm/tests/drm_gem_shmem_test.c | 16 +- drivers/gpu/drm/tests/drm_mm_test.c | 2 - drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c | 4 +- drivers/gpu/drm/ttm/tests/ttm_mock_manager.c | 18 +- drivers/gpu/drm/ttm/tests/ttm_mock_manager.h | 4 +- drivers/gpu/drm/vc4/vc4_bo.c | 10 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/drm/xe/xe_pt.c | 14 +- drivers/gpu/drm/xe/xe_res_cursor.h | 34 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr.c | 73 +- drivers/gpu/drm/xe/xe_ttm_vram_mgr_types.h | 4 +- drivers/gpu/drm/xe/xe_wopcm.c | 15 +- drivers/gpu/host1x/bus.c | 4 +- drivers/gpu/tests/Makefile | 4 + .../drm_buddy_test.c => tests/gpu_buddy_test.c} | 316 ++--- .../{drm/lib/drm_random.c => tests/gpu_random.c} | 18 +- .../{drm/lib/drm_random.h => tests/gpu_random.h} | 18 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/gigabyte_waterforce.c | 4 +- drivers/hwmon/nzxt-kraken3.c | 6 +- drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx.c | 126 +- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 + drivers/infiniband/core/umem_dmabuf.c | 61 + drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 7 +- drivers/infiniband/sw/siw/siw_verbs.c | 44 +- drivers/input/misc/ims-pcu.c | 32 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 22 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/iommu/iommufd/fault.c | 12 +- drivers/md/dm-integrity.c | 2 +- drivers/md/dm.c | 11 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/i2c/alvium-csi2.c | 21 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +- drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + .../platform/chips-media/wave5/wave5-vpu-enc.c | 29 +- drivers/media/platform/marvell/cafe-driver.c | 1 + drivers/media/platform/nuvoton/npcm-video.c | 34 +- .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- .../media/platform/qcom/camss/camss-csid-gen2.c | 47 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-core.c | 6 +- drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/media/v4l2-core/v4l2-subdev.c | 4 + drivers/misc/mei/bus.c | 16 +- drivers/misc/nsm.c | 3 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/net/amt.c | 101 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/airoha/Kconfig | 18 + drivers/net/ethernet/airoha/Makefile | 6 + .../net/ethernet/{mediatek => airoha}/airoha_eth.c | 5 +- drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 22 +- drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/google/gve/gve.h | 3 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 64 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 - drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_parser.c | 3 + drivers/net/ethernet/intel/ice/ice_ptp.c | 7 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 14 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 28 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 29 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mediatek/Kconfig | 8 - drivers/net/ethernet/mediatek/Makefile | 1 - drivers/net/ethernet/mellanox/mlx5/core/dpll.c | 81 ++ .../ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- .../net/ethernet/mellanox/mlx5/core/esw/bridge.c | 6 +- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/port.c | 39 +- .../mellanox/mlx5/core/steering/hws/mlx5hws_bwc.c | 355 +++--- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/realtek/rtase/rtase.h | 8 + drivers/net/ethernet/realtek/rtase/rtase_main.c | 197 +++ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 + drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 1 + drivers/net/geneve.c | 3 + drivers/net/gtp.c | 17 +- drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/mctp/mctp-i3c.c | 11 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/ppp/ppp_generic.c | 154 ++- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/ath/wil6210/cfg80211.c | 1 + drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/cfg.c | 1 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 13 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/cfg80211.c | 3 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/nvme/target/admin-cmd.c | 21 + drivers/nvme/target/core.c | 37 + drivers/nvme/target/discovery.c | 14 + drivers/nvme/target/fabrics-cmd-auth.c | 38 +- drivers/nvme/target/fabrics-cmd.c | 43 + drivers/nvme/target/nvmet.h | 8 + drivers/platform/loongarch/loongson-laptop.c | 1 + .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/regulator/mt6358-regulator.c | 2 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 50 +- drivers/scsi/hosts.c | 2 + drivers/scsi/scsi_error.c | 22 +- drivers/scsi/scsi_priv.h | 1 + drivers/soc/qcom/ice.c | 17 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 30 + drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 59 +- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 100 +- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/uio/uio_hv_generic.c | 8 +- drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/core/port.c | 2 + drivers/usb/core/sysfs.c | 8 +- drivers/usb/gadget/function/f_ecm.c | 4 +- drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 20 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/u_serial.c | 3 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/legacy/inode.c | 3 +- drivers/usb/gadget/udc/aspeed-vhub/hub.c | 3 +- drivers/usb/gadget/udc/at91_udc.c | 3 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 13 +- drivers/usb/gadget/udc/dummy_hcd.c | 43 +- drivers/usb/gadget/udc/fsl_udc_core.c | 94 +- drivers/usb/gadget/udc/fsl_usb2_udc.h | 1 + drivers/usb/gadget/udc/omap_udc.c | 3 +- drivers/usb/gadget/udc/pxa27x_udc.c | 3 +- drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vdpa/vdpa_user/iova_domain.c | 157 ++- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/Kconfig | 1 + drivers/video/fbdev/core/bitblit.c | 120 +- drivers/video/fbdev/core/fbcon.c | 420 +++--- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +-- drivers/video/fbdev/core/fbcon_cw.c | 146 +-- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 +-- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c | 2 +- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/addr_list.c | 50 + fs/afs/cell.c | 532 ++++---- fs/afs/cmservice.c | 92 +- fs/afs/dynroot.c | 14 +- fs/afs/fs_probe.c | 32 +- fs/afs/fsclient.c | 4 +- fs/afs/internal.h | 98 +- fs/afs/main.c | 13 +- fs/afs/mntpt.c | 6 +- fs/afs/proc.c | 16 +- fs/afs/rxrpc.c | 19 +- fs/afs/security.c | 49 +- fs/afs/server.c | 621 ++++----- fs/afs/server_list.c | 6 +- fs/afs/super.c | 12 +- fs/afs/vl_alias.c | 8 +- fs/afs/vl_rotate.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/extent_map.c | 4 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/ceph/dir.c | 7 +- fs/ceph/ioctl.c | 6 + fs/crypto/inline_crypt.c | 57 +- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/f2fs/super.c | 25 +- fs/iomap/buffered-io.c | 34 +- fs/namei.c | 43 + fs/nfsd/nfs4xdr.c | 8 +- fs/nfsd/vfs.c | 7 +- fs/nfsd/vfs.h | 2 +- fs/overlayfs/copy_up.c | 12 +- fs/overlayfs/xattrs.c | 2 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/proc/task_mmu.c | 14 +- fs/smb/client/cifsglob.h | 19 +- fs/smb/client/misc.c | 34 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/common/cifsglob.h | 30 + fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smb_common.h | 14 +- fs/smb/server/smbacl.c | 42 +- fs/xfs/libxfs/xfs_attr_leaf.c | 22 + fs/xfs/libxfs/xfs_attr_leaf.h | 3 + fs/xfs/scrub/cow_repair.c | 182 ++- fs/xfs/scrub/trace.h | 28 +- include/drm/drm_buddy.h | 174 +-- include/drm/drm_connector.h | 6 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/cleanup.h | 9 + include/linux/cred.h | 15 + include/linux/dpll.h | 4 + include/linux/firmware/xlnx-zynqmp.h | 13 + include/linux/fscrypt.h | 18 +- include/linux/gpu_buddy.h | 188 +++ include/linux/memory_hotplug.h | 8 +- include/linux/mlx5/mlx5_ifc.h | 13 +- include/linux/mmzone.h | 7 +- include/linux/namei.h | 1 + include/linux/ppp_channel.h | 3 +- include/linux/seqlock.h | 10 +- include/linux/sunrpc/svcsock.h | 3 + include/linux/sunrpc/xdr.h | 19 +- include/linux/vtime.h | 6 + include/media/v4l2-async.h | 4 +- include/media/videobuf2-core.h | 8 +- include/net/af_rxrpc.h | 27 +- include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 40 +- include/net/bluetooth/rfcomm.h | 3 + include/net/cfg80211.h | 7 +- include/net/netfilter/nf_tables.h | 37 - include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 3 - include/net/sctp/structs.h | 3 +- include/rdma/ib_umem.h | 19 + include/scsi/scsi_host.h | 3 + include/trace/events/afs.h | 63 +- include/trace/events/rxrpc.h | 5 +- include/uapi/linux/btrfs.h | 2 +- include/uapi/linux/dpll.h | 24 + include/uapi/linux/netfilter/nf_tables.h | 10 +- init/Kconfig | 3 + init/main.c | 45 - io_uring/rw.c | 42 +- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/verifier.c | 67 +- kernel/locking/spinlock_rt.c | 27 +- kernel/trace/ftrace.c | 13 + kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- lib/bootconfig.c | 65 + lib/compat_audit.c | 12 +- mm/damon/core.c | 13 + mm/hugetlb.c | 7 +- mm/internal.h | 47 + mm/memory_hotplug.c | 13 +- mm/memremap.c | 4 +- mm/mm_init.c | 36 +- mm/sparse-vmemmap.c | 336 +++++ mm/sparse.c | 112 +- net/bluetooth/hci_conn.c | 54 +- net/bluetooth/hci_core.c | 27 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 25 +- net/bluetooth/iso.c | 6 +- net/bluetooth/mgmt.c | 87 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/nft_meta_bridge.c | 20 - net/bridge/netfilter/nft_reject_bridge.c | 1 - net/can/bcm.c | 528 ++++++-- net/can/isotp.c | 278 +++- net/can/j1939/transport.c | 18 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/filter.c | 6 +- net/core/gro.c | 4 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/ip_gre.c | 4 +- net/ipv4/netfilter/nft_dup_ipv4.c | 1 - net/ipv4/netfilter/nft_fib_ipv4.c | 2 - net/ipv4/netfilter/nft_reject_ipv4.c | 1 - net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/tcp_output.c | 8 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_gre.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/netfilter/nft_dup_ipv6.c | 1 - net/ipv6/netfilter/nft_fib_ipv6.c | 2 - net/ipv6/netfilter/nft_reject_ipv6.c | 1 - net/ipv6/raw.c | 2 +- net/ipv6/tcp_ipv6.c | 2 + net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/cfg.c | 12 +- net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/rx.c | 2 + net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mpls/af_mpls.c | 3 + net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_tables_api.c | 315 +---- net/netfilter/nft_bitwise.c | 137 +- net/netfilter/nft_byteorder.c | 11 - net/netfilter/nft_cmp.c | 3 - net/netfilter/nft_compat.c | 10 - net/netfilter/nft_connlimit.c | 1 - net/netfilter/nft_counter.c | 21 +- net/netfilter/nft_ct.c | 46 - net/netfilter/nft_dup_netdev.c | 1 - net/netfilter/nft_dynset.c | 1 - net/netfilter/nft_exthdr.c | 34 - net/netfilter/nft_fib.c | 51 +- net/netfilter/nft_fib_inet.c | 1 - net/netfilter/nft_fib_netdev.c | 30 +- net/netfilter/nft_flow_offload.c | 1 - net/netfilter/nft_fwd_netdev.c | 2 - net/netfilter/nft_hash.c | 36 - net/netfilter/nft_immediate.c | 12 - net/netfilter/nft_last.c | 1 - net/netfilter/nft_limit.c | 2 - net/netfilter/nft_log.c | 1 - net/netfilter/nft_lookup.c | 12 - net/netfilter/nft_masq.c | 3 - net/netfilter/nft_meta.c | 45 - net/netfilter/nft_nat.c | 2 - net/netfilter/nft_numgen.c | 22 - net/netfilter/nft_objref.c | 2 - net/netfilter/nft_osf.c | 25 - net/netfilter/nft_payload.c | 47 - net/netfilter/nft_queue.c | 2 - net/netfilter/nft_quota.c | 14 +- net/netfilter/nft_range.c | 1 - net/netfilter/nft_redir.c | 3 - net/netfilter/nft_reject_inet.c | 1 - net/netfilter/nft_reject_netdev.c | 1 - net/netfilter/nft_rt.c | 1 - net/netfilter/nft_socket.c | 26 - net/netfilter/nft_synproxy.c | 1 - net/netfilter/nft_tproxy.c | 1 - net/netfilter/nft_tunnel.c | 26 - net/netfilter/nft_xfrm.c | 27 - net/openvswitch/actions.c | 19 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/recv.c | 15 + net/rds/tcp.c | 4 +- net/rxrpc/af_rxrpc.c | 24 +- net/rxrpc/ar-internal.h | 14 +- net/rxrpc/call_accept.c | 79 +- net/rxrpc/call_event.c | 31 +- net/rxrpc/call_object.c | 44 +- net/rxrpc/conn_client.c | 20 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/conn_object.c | 8 +- net/rxrpc/input.c | 7 +- net/rxrpc/io_thread.c | 108 +- net/rxrpc/peer_event.c | 10 +- net/rxrpc/peer_object.c | 35 +- net/rxrpc/recvmsg.c | 26 +- net/rxrpc/rxperf.c | 10 +- net/rxrpc/security.c | 4 +- net/rxrpc/sendmsg.c | 8 +- net/rxrpc/txbuf.c | 4 +- net/sched/act_tunnel_key.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/protocol.c | 21 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sctp/sysctl.c | 9 +- net/sunrpc/svcsock.c | 51 +- net/sunrpc/xdr.c | 210 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 7 +- net/tls/tls_device.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 165 ++- net/wireless/chan.c | 7 +- net/wireless/core.c | 46 +- net/wireless/core.h | 3 +- net/wireless/mlme.c | 8 +- net/wireless/nl80211.c | 251 ++-- net/wireless/pmsr.c | 29 +- net/wireless/rdev-ops.h | 5 +- net/wireless/reg.c | 53 +- net/wireless/scan.c | 47 +- net/wireless/sme.c | 12 +- net/wireless/trace.h | 10 +- net/wireless/util.c | 7 +- net/wireless/wext-compat.c | 317 ++--- net/wireless/wext-sme.c | 43 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_nat_keepalive.c | 45 +- net/xfrm/xfrm_policy.c | 4 +- rust/bindings/lib.rs | 4 + rust/uapi/lib.rs | 4 + security/landlock/fs.c | 51 +- security/landlock/fs.h | 33 +- security/landlock/task.c | 36 +- sound/core/seq/seq_timer.c | 13 +- sound/core/timer.c | 21 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/cs35l41_hda.c | 13 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 25 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 300 ++--- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/quirks.c | 2 + tools/objtool/check.c | 1 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 +++ tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/af_unix/config | 1 + tools/testing/selftests/net/openvswitch/config | 16 + 715 files changed, 11519 insertions(+), 7953 deletions(-)

1 month, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage August 2026